Comment by user_7832

4 days ago

Small feedback: the "create password" requires a symbol too, which Google's password manager by default does not use. I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password (or at least, Google thinks so). Great idea nonetheless!

6 comments

user_7832

Reply
troupo  4 days ago

> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password

This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Besides,

--- start quote ---

Using complexity requirements (that is, where staff can only use passwords that are suitably complex) is a poor defence against guessing attacks. It places an extra burden on users, many of whom will use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required 'complexity' criteria.

https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

--- end quote ---

  • user_7832  4 days ago

    > This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

    Oh, I'm well aware (with the concept and comic both). My passwords that I set for myself almost always are like that. It's just that I wasn't sure if OP was aware of it, due to what their site was asking.

  • RugnirViking  4 days ago

    This. The siren song of "oh but increasing the number of characters makes brute forcing harder exponentially" is defeated in practice by the fact that everybody's password is following a few predictable patterns. You know what else increases the complexity exponentially? Longer passwords

    • bitexploder  4 days ago

      You know what else increases the odds you can’t brute force it? Not having one :)

      Seriously though, the best password boxes are one that have an entropy meter and check that your password has never been in a breach.