Hacker News Reader

It seems like the major gripe is against passwords like "p@assword", not against passwords like "correcthorsebatterystaple".

If you truly choose 4 words randomly, the number of possibilities is > 1e24 (at least 1 million words in english language, likely not including slang or names).

View on HN

You want the spaces. Leaving them out leads to collisions, which burn entropy.

You could also use _ or CamelCase to be a bit more friendly towards stupid password inputs.

My biggest problem with the passphrase system is how hard it is to use with lots of services. Plenty of places still enforce stupid requirements like maximum lengths, one of each type of character, or no spaces.

Reply on news.ycombinator.com