Vince Mallory

A strength score is a model, and every model is optimistic, so the number is worth reading alongside what it assumed. The keyspace is the product of the character set and the length, and a score derived from it assumes the attacker gets one guess per attempt at the rate the number implies. Real attacks try the obvious combinations first, which a pure keyspace figure does not account for. Length dominates because it multiplies the keyspace while a symbol choice adds a factor. Going from eight to sixteen characters multiplies by a large number; adding symbols to eight characters multiplies by much less. That is the arithmetic behind the advice, and it is the part worth remembering. Composition rules push people toward predictable substitutions, which reduces the effective keyspace below the nominal one. Passphrases drawn from ordinary words and longer are stronger in practice than short strings meeting a rule, and that is not a close call. Storage and reuse are where the remaining risk sits. A generator running in your browser produces nothing for an attacker to take, and a password reused across two sites fails at the second one regardless of its length. I cover managers as well, briefly, because the storage problem has a known solution and a spreadsheet does not. Where a form asks for a password policy, the useful question is what the policy is protecting against. A policy that requires a symbol and caps the length can push people toward a pattern an attacker will try before anything else.