Hacker News Reader

The author has completely misunderstood the problem. The problem is not using passwords that are too short. The problem is sharing passwords between sites. 12 characters is plenty, but no password length will protect you if you use the same password everywhere.

Also, your bank is not the most important password you have. That would be your email, which is used to reset all other passwords.

View on HN

As the author, allow me to address this.

I agree with your statement that sharing passwords between sites is a bad idea. And I don't do it. But I would assert that longer passwords of wider character sets will be harder to crack if a database is compromised--as was the case with LinkedIn. If my password is 8 characters, alphanumeric, it doesn't matter if it's original to that site. If there's a compromise, I'm not going to be in a good place.

Also, my bank doesn't allow for password resets via email. But I would agree that my email account is at the top as well. Fortunately, Google is much smarter about their password rules.

Reply on news.ycombinator.com