← Back to context

Comment by troupo

4 days ago

> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password

This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Besides,

--- start quote ---

Using complexity requirements (that is, where staff can only use passwords that are suitably complex) is a poor defence against guessing attacks. It places an extra burden on users, many of whom will use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required 'complexity' criteria.

https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

--- end quote ---

4 comments

troupo

Reply
user_7832  4 days ago

> This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Oh, I'm well aware (with the concept and comic both). My passwords that I set for myself almost always are like that. It's just that I wasn't sure if OP was aware of it, due to what their site was asking.

RugnirViking  4 days ago

This. The siren song of "oh but increasing the number of characters makes brute forcing harder exponentially" is defeated in practice by the fact that everybody's password is following a few predictable patterns. You know what else increases the complexity exponentially? Longer passwords

  • bitexploder  4 days ago

    You know what else increases the odds you can’t brute force it? Not having one :)

    Seriously though, the best password boxes are one that have an entropy meter and check that your password has never been in a breach.