Hacker News Reader

Given a reasonably sized keyspace (which FB does have) a factor of three should not be a big deal.

You are right, but given the fact that most people still use very common words for their passwords, a 3 times increase is a very huge number. A recent story on HN stated the fact that passwords from sites that had their databases leaked, mostly consisted of dictionary based passwords.

One could posit that the negative security impact on such a password is negligible, since the password is already weak.

I think it would be worrisome if there weren't protective measures already in place, such as limited login attempts, two-factor auth, and so on.

The other weakness would be the repetition of that password on sites that place a low priority on, or are ignorant about, security. At which point, it doesn't even matter.

Reply on news.ycombinator.com