- May 13, 2017
- 2,692
How long should a password be?
- Thread starter Brye
- Start date
- Oct 2, 2011
- 1,559
Some of my passwords are 75 characters long (emails, facebook, forums). If you have a password manager, might as well use it to generate a long complex one !!
- May 13, 2017
- 2,692
- Jun 6, 2017
- 477
My (limited) understanding is that hackers can access websites using one of 4 main techniques...
1. Social engineering methods (no hacking required).
2. Trying out previously compromised login credentials (which can be purchased on the dark web) on multiple websites in the hope that some will work. This is why unique passwords for each site are important.
3. Using brute force techniques to try to guess passwords (which is why length and complexity are important). This is also why its good to avoid dictictionary words or common phrases.
4. Directly hacking websites to find databases containing the login credentials of each user. This is out of the control of the user as you just have to trust the security policies of the website holding your password. Whether a stolen password database is of any use to the hacker depends on how it is stored. Plain text would be very easy to exploit, whereas 'salted' hash values would be very difficult to exploit. However, if the database contains unsalted hash values (as many apparently do) then it is open to attack using Rainbow Tables. In that case, it doesn't matter how long or complex a password is- every account is potentially at risk of being breached- even if a password is a 128 character long string of random chacaracters.
Please can someone tell me if I am correct about this ?
Have I got anything wrong ?
1. Social engineering methods (no hacking required).
2. Trying out previously compromised login credentials (which can be purchased on the dark web) on multiple websites in the hope that some will work. This is why unique passwords for each site are important.
3. Using brute force techniques to try to guess passwords (which is why length and complexity are important). This is also why its good to avoid dictictionary words or common phrases.
4. Directly hacking websites to find databases containing the login credentials of each user. This is out of the control of the user as you just have to trust the security policies of the website holding your password. Whether a stolen password database is of any use to the hacker depends on how it is stored. Plain text would be very easy to exploit, whereas 'salted' hash values would be very difficult to exploit. However, if the database contains unsalted hash values (as many apparently do) then it is open to attack using Rainbow Tables. In that case, it doesn't matter how long or complex a password is- every account is potentially at risk of being breached- even if a password is a 128 character long string of random chacaracters.
Please can someone tell me if I am correct about this ?
Have I got anything wrong ?
- May 29, 2018
- 2,728
I have slowly updated my passwords to 14 characters as bitwarden gives it by default
- May 13, 2017
- 2,692
Why only 14? Using a password manager, only the sky is the limit or the webpage's policy. I would consider 20 as a bare minimum.
Equal to or more than 8 characters.
Equal to or less than 16 characters.
Logging in on a TV App is easier with a shorter password.
Edit: TV apps may tell you to visit a website with a code.
Equal to or less than 16 characters.
Logging in on a TV App is easier with a shorter password.
Edit: TV apps may tell you to visit a website with a code.
Last edited:
- Jan 26, 2020
- 1,628
How long should your password be? | Proton
A strong password doesn’t have to be 30 characters long. But if you’re using an eight-character password, you have a good chance of being hacked.
protonmail.com
Similar threads
