20 karma · joined December 23, 2022
Imagine the password for my Gmail is Watermelon45. Theory says that's super weak, but I'm not a watermelon farmer and I wasn't born in 1945 so nobody who knows me is ever going to guess it. I trust Google will effectively block against brute force attacks by rate limiting login attempts, and if Google is breached and the password cracked as long as I'm not reusing it somewhere else it doesn't matter.
Now if I encrypt my portable SSD with the same password that is a problem. It would be trivial to brute force. So external storage, computer logins, ssh keys are perhaps examples of the very few situations where high entropy passwords are actually useful. For everything else which is 95% of passwords, easy to remember but unique is fine.