>People aren't good at memorizing long lists of things
It's much easier to remember a 40 character passphrase of real words than a 12 character password of random symbols including punctuation
back
2 comments
Yes, but it doesn't solve the problem of memorizing a list of 40 character passphrases for every single website/app that you use. Length alone as a password strength requirement is not sufficient. Length alone only further encourages password reuse, because people won't memorize more than one or two passwords, especially as they get longer.
A 40 character password of real words is usually easier to crack than a random 12 character string, though.
Citation needed (that sounds wrong without seeing the maths).
But also missing the point. It just has to be better than the usual 8 + some punctuation at the end that most people resort to when faced with these shitty, asinine password rules.
English words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.
It really starts to depend on the details. If there are 10,000 words and you use 5 of them, that is 1.1x more than 12 characters where you only use lowercase letters, numbers, and shifted numbers. Tweak the allowed symbols, length, and your dictionary and you can make either one look better than the other.
I think there are probably less than 10,000 words that people would choose for their password, and that people use capital letters... maybe, but don't use 12 character passwords (8 more reasonable) so it could really go either way.