Hacker News Reader

Comment by dblitt | Hacker News Reader

> we have increased the minimum password length to 48 characters.

Isn't this complete overkill? I suppose this effectively mandates the use of a password manager, but I wonder where the 48 number came from.

View on HN

Well, standard policy for cryptographic keys is to have 256 bits of entropy, with the paranoid number being 512. So if they're using ascii-printable characters, uniform random 48-char passwords have ~315 bits of entropy. That doesn't seem too far off. Basically this means you don't have to trust your key derivation function as much.

Are 512 bit encryption keys even a thing? I thought 256 bits is already for the paranoid, with AES128 being sufficiently secure until quantum computation becomes feasible. I don't even know a symmetric cipher that uses 512 bit keys.

Also, since we are talking about hash functions, keys don't even enter the discussion. Hashing is about making password guessing difficult. The length alone doesn't determine how difficult it is anyway, since there are 48 character passwords in popular wordlists. Just enforce 2fa, use argon2 or similar with a minimum password length of 12 and call it a day.

Ah right, i got confused between hash function sizes and cipher key sizes. It's 128-256.

Ugh I use it on my android TV 48 character password would kill my use case

Those password policies only apply to their internal admin panel

This is for admin passwords, not user passwords, as i read it.

When it becomes mandatory for users, I'll be safe using:

hunter222222222222222222222222222222222222222222

Mullvad does not have passwords for their users.

Reply on news.ycombinator.com