Comment on Please create a non-secure password.
groet@feddit.org 3 days agoMight be a minimum of 16 chars. Or the parsing is broken and treats the ’ as the end of the password
Comment on Please create a non-secure password.
groet@feddit.org 3 days agoMight be a minimum of 16 chars. Or the parsing is broken and treats the ’ as the end of the password
teletext@reddthat.com 3 days ago
Yeah, I’d consider anything less than 20 characters broken. Much too likely that it’s contained in a rainbow table, regardless how many special characters you use. Can I remember many 20 character passwords? No, but my password manager can.
CanadaPlus@lemmy.sdf.org 2 days ago
That’s a big rainbow table. Like, way too big to exist assuming you mean random ascii characters (on the order of 10^42^ entries).
teletext@reddthat.com 2 days ago
Base85 contains just about every printable ASCII character, so I’ll use that as a base. 85^16^ ~= 10^31^ -> extremely huge, but still feasible at least for state actors. 85^20^ ~= 10^39^ -> if I read Wolfram Alpha’s comparison correctly, that is more information than is believed to be contained in the DNA of a living creatures combined. That’s why I’d recommend >= 20 characters.
frezik@midwest.social 2 days ago
State actors don’t generally need to break passwords. They ask the company “nicely” and they get what they want. The exception would be if that password is being used to encrypt data.
CanadaPlus@lemmy.sdf.org 2 days ago
10^31^ is ridiculously huge too. The NSA probably works on EB scales, which is “only” 10^18^ bytes. If you can get up to 10^22^ you’re fine against brute force-style attacks.
Aganim@lemmy.world 2 days ago
I let my password manager create 32 char passwords, that should be enough for a while. But of course then you have websites that throw you a ‘your password is too long’ message and have you find out by trial and error that they only accept 12 characters.
Or the off-by-one errors where the insist that 24 chars are the max, but in reality they accept 23. Probably never tested the limit.
Or websites that truncate your password after X characters when registering, but not when logging in, so you end up with an incorrect password and good luck finding out which limit the registration page actually uses.