Hacker News Reader

Yes, in this case it would be easier to brute-force the key instead of the password, so the additional characters don't really help.

Brute-forcing the underlying key doesn’t help if you’re trying to mount a credential stuffing attack. Brute-forcing the password does.