Hacker News Reader

Comment by user_7832 | Hacker News Reader

Small feedback: the "create password" requires a symbol too, which Google's password manager by default does not use. I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password (or at least, Google thinks so). Great idea nonetheless!

View on HN

> I'm fairly sure a double-digit-level alphanumeric jumble is sufficient to be a password

This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Besides,

--- start quote ---

Using complexity requirements (that is, where staff can only use passwords that are suitably complex) is a poor defence against guessing attacks. It places an extra burden on users, many of whom will use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required 'complexity' criteria.

https://www.ncsc.gov.uk/collection/passwords/updating-your-a...

--- end quote ---

This. The siren song of "oh but increasing the number of characters makes brute forcing harder exponentially" is defeated in practice by the fact that everybody's password is following a few predictable patterns. You know what else increases the complexity exponentially? Longer passwords

You know what else increases the odds you can’t brute force it? Not having one :)

Seriously though, the best password boxes are one that have an entropy meter and check that your password has never been in a breach.

Seconded

https://blog.codinghorror.com/password-rules-are-bullshit/

> This isn't required either. Of course there's an xlcd for that: https://xkcd.com/936/

Oh, I'm well aware (with the concept and comic both). My passwords that I set for myself almost always are like that. It's just that I wasn't sure if OP was aware of it, due to what their site was asking.

thanks! adjusting it now

Reply on news.ycombinator.com