Hacker News Reader

Comment by WhitneyLand | Hacker News Reader

This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?

Point is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/

Yep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)

Add second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.

I use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.

Pass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.

One other issue is that this indicates a site doing something they should not be. The best practice for password storage is to use a secure password hash like bcrypt, and not store the actual password at all.

If one actually does this, the length of the password becomes almost irrelevant to the server. You might want to reject 10MB passwords or something, to prevent someone from taking up all your RAM during login, but the difference between 16 characters and 1024 (or 72, the max for bcrypt) is irrelevant.

Reply on news.ycombinator.com