you are viewing a single comment's thread
view the rest of the comments
[–] 54 points 2 years ago (9 children)

Lol I recently have found the opposite!

  • source
  • hideshow 9 child comments
  • [–] 33 points 2 years ago (6 children)

    Might be a minimum of 16 chars. Or the parsing is broken and treats the ' as the end of the password

  • source
  • parent
  • hideshow 6 child comments
  • [+] 5 points 2 years ago* (last edited 1 year ago) (5 children)
  • [–] 5 points 2 years ago* (last edited 2 years ago) (3 children)

    That's a big rainbow table. Like, with just precomputed values and random ascii character passwords it's on the order of 10^42^ entries. You can shave that down a bit probably with all the tricks rainbow tables use, but I think you're safe.

  • source
  • parent
  • hideshow 3 child comments
  • [+] 1 point 2 years ago* (last edited 1 year ago) (2 children)
  • [–] 1 point 2 years ago* (last edited 2 years ago)

    10^31^ is ridiculously huge too. The NSA probably works on EB scales, which is "only" 10^18^ bytes. If you can get up to 10^22^ equally likely passwords you're fine against dragnet, brute force-style attacks. (If you're zombie Bin Laden and the NSA will stop for a whole year cracking your drive, and doesn't have any shortcuts, maybe you need 10^39^ I guess)

    That being said, if more characters is no problem, go ahead and do that. I'm not saying more security for free is a bad thing.

  • source
  • parent
  • [–] 5 points 2 years ago*

    I let my password manager create 32 char passwords, that should be enough for a while. But of course then you have websites that throw you a 'your password is too long' message and have you find out by trial and error that they only accept 12 characters.

    Or the off-by-one errors where they insist that 24 chars are the max, but in reality they accept 23. Probably never tested the limit.

    Or websites that truncate your password after X characters when registering, but not when logging in, so you end up with an incorrect password and good luck finding out which limit the registration page actually uses.

  • source
  • parent