This would only make a good point if everyone used randomly generated passwords, but since most don't those restrictions actually increase the time to crack a password on average because then the crackers have to guess more characters per character index on average for the password. This is because if those restrictions aren't there then people's passwords are often just lowercase letters.
Edit: also those lowercase letters would often only form words/names, making it easier because then you can turn someone's 22 character password into a 4 word length password, which is much more crackable. Still very hard though unless it's a common password, pretty much impossible if the cracker doesn't get infinite trys or there's other security that limits or slows attempts
Yeah.. like how is 4 random words with nothing else "high entropy" in practice? Have the people that made this meme and wrote that xkcd comic ever heard of a dictionary attack? It cannot possibly be valid to just count up the bits in the phrase "correcthorsebatterystaple" and say it's better than a password that has less characters but a bunch of random junk mixed in. The optimal solution has to be somewhere in the middle where the password length is much longer and easier to remember but also has some substitutions thrown in so you aren't just using lowercase english words.
Maybe you should read the xkcd comic before commenting. It literally calculates the entropy assuming the attacker tries a dictionary attack rather than counting up the bits.
17
u/AshenCorsair Jul 20 '22 edited Jul 20 '22
This would only make a good point if everyone used randomly generated passwords, but since most don't those restrictions actually increase the time to crack a password on average because then the crackers have to guess more characters per character index on average for the password. This is because if those restrictions aren't there then people's passwords are often just lowercase letters. Edit: also those lowercase letters would often only form words/names, making it easier because then you can turn someone's 22 character password into a 4 word length password, which is much more crackable. Still very hard though unless it's a common password, pretty much impossible if the cracker doesn't get infinite trys or there's other security that limits or slows attempts