Hacker News Reader

Comment by AdmiralAsshat | Hacker News Reader

Too bad as well that very, very few sites support 80 character long passwords.

Ever since I switched to a password manager, I've always made sure that the length of it is the maximum length that the site will accept.

I am getting pretty pissed with the sites that have ridiculous "security" schemes like 1 capital letter, 1 one number, 1 special character, must rotate every three months...but will only allow a password between 8-12 characters long.

View on HN

Grandparent was suggesting that 80-bit, not 80-character, passwords were sufficient -- though I agree as a rule that more characters is generally better.

wait, which one is strong enough under MD5 hashing? 80 bit or 80 character?

MD5 caps your overall complexity at 128 bits (realistically probably 110 bits with modern attacks). Typical english text has about 3 bits/character, completely random ascii is 7 bits/character (though that includes control codes you probably can't put in a password field). So 80 characters of typical English would be ~240 bits (obviously 80 characters of just 'aaa...' would be less), so definitely overkill for MD5; ~36 characters (110/3) is the point where you max out what you can do with MD5, and ~26 characters (80/3) is good enough. You can reduce these numbers a bit by using upper case, symbols etc., but personally I find it easier to remember 26 characters of normal English than 13 characters of random letters and symbols.

80 bits of entropy (20 really random hex chars) should be safe enough.

Reply on news.ycombinator.com