Hacker News Reader

Yes - the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it. Mixing different characters into passwords is a technique to limit the effectiveness of dictionary attacks against that password. Both techniques should ideally be combined for really strong passwords, but length alone is a good place to start.

View on HN

> the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it

This is incorrect. The time (or resources, in general) required to perform a brute force attack grows exponentially as the length of a password increases. For example, let's say you use lower-case letters only, but choose them uniformly at random. If it takes an attacker one day to crack your password now, then adding a single letter means that it takes the same attacker 26 days, and adding 4 letters makes it so the same attack would take over 1,000 years.

Reply on news.ycombinator.com