Hacker News Reader

Locking you out after a few wrong tries only protects against online attacks. If someone gets access to the database, they have as many attempts as they want.

View on HN

Brute force a strong 20 character password? Won't the sun have burnt out by the time that is done?

I use strong 12 character passwords at work, on the off chance i have to type them out. And as a favour to anyone else that might have to.

Are there disadvantages in allowing users arbitrarily long passwords (or with a very high limit, e.g. 256 bytes)? No.

Are there advantages? Yes: the longer the password is, the stronger it is. It doesn't matter if there's a specific point after which cracking takes time till the death of the universe. So there's no point in imposing a limit.

Besides, too many websites limit password length to ridiculous lengths like 12.

You should reach out to the developers of all the major operating systems and explain how they've been doing it wrong all these years because they all set hard limits.

For a 20-character password to be strong, you pretty much need to use random characters; you cannot use the superior “correct horse battery staple” approach as you’d be limited to two words, which isn’t very secure.

True, a pass phrase is a reasonable use of "passwords" >20 characters.

Reply on news.ycombinator.com