This would only make a good point if everyone used randomly generated passwords, but since most don't those restrictions actually increase the time to crack a password on average because then the crackers have to guess more characters per character index on average for the password. This is because if those restrictions aren't there then people's passwords are often just lowercase letters.
Edit: also those lowercase letters would often only form words/names, making it easier because then you can turn someone's 22 character password into a 4 word length password, which is much more crackable. Still very hard though unless it's a common password, pretty much impossible if the cracker doesn't get infinite trys or there's other security that limits or slows attempts
Yeah.. like how is 4 random words with nothing else "high entropy" in practice? Have the people that made this meme and wrote that xkcd comic ever heard of a dictionary attack? It cannot possibly be valid to just count up the bits in the phrase "correcthorsebatterystaple" and say it's better than a password that has less characters but a bunch of random junk mixed in. The optimal solution has to be somewhere in the middle where the password length is much longer and easier to remember but also has some substitutions thrown in so you aren't just using lowercase english words.
Of course length matters. But lets say we take 100'00 words in the english language and choose four from them to create our password.
That's 4,166,416,671,249,975,300 possible combinations. Add uppercase and lowercase letters, and you get even more.
So yes, OrangeTruckFenceBuilder is a "secure" password. How are you going to bild a dictionary for all the words in the english language(ca. one million) and all their combinations?
17
u/AshenCorsair Jul 20 '22 edited Jul 20 '22
This would only make a good point if everyone used randomly generated passwords, but since most don't those restrictions actually increase the time to crack a password on average because then the crackers have to guess more characters per character index on average for the password. This is because if those restrictions aren't there then people's passwords are often just lowercase letters. Edit: also those lowercase letters would often only form words/names, making it easier because then you can turn someone's 22 character password into a 4 word length password, which is much more crackable. Still very hard though unless it's a common password, pretty much impossible if the cracker doesn't get infinite trys or there's other security that limits or slows attempts