Hacker News new | ask | show | jobs
by CDRdude 1925 days ago
One point to longer passwords is passphrases. Passphrases are easier to remember than complicated passwords, and often longer. I can remember the 37 character passphrase “This passw0rd is far too long for me.” much more easily than the 20 character “W64$hmIbAZ7:-IirN57p”
2 comments

Right but op mentioned using a password manager, so that doesn't really apply.
Unless you sometimes need to type the password manually.
What about dictionary attacks?
Irrelevant. In a "passphrase", the "symbols" are entire words, instead of single-byte ASCII characters. So "ResearchWannabeProbablyMagmaDeltaCondoneWannabeImpurityScrabbleAbidep" consists of 10 symbols chosen from a list of 7776 symbols. As opposed to "!Z['$-t]8:" which is 10 characters from a list of only 96. Since the entropy of a password (and thus resistance to brute-froce and dictionary attacks) is $log_{2}(Symbols_in_list^{Length_of_password_in_symbols})$, the passphrase has 129 bits of entropy and the password only has 65 bits.

There's no concern about dictionary attacks, since there are too many "words" of multiple "symbols". The symbols just happen to be composed of sequences of ASCII characters, instead of single characters. The analog for regular passwords would be a dictionary consisting only of single letters/numbers/symbols.