Password Complexity, Good or bad?

@Dashrender said:

Is there a real difference? A meaningful difference?

Yes.

I plan to live between those two numbers, so I need the stronger password.

Just change it at least once between now and then and you should be fine.

BRRABill

@Dashrender said:

Is there a real difference? A meaningful difference?

My point is that just adding a capital or symbol adds a lot of complexity to the password. It can make a big difference when dealing with shorter passwords. (Say 12 or less.) Why totally take them out of the equation? Especially at the beginning or end of the passphrase? Or on sites that don't allow longer passwords for whatever reason.

BRRABill

@Dashrender said:

Just change it at least once between now and then and you should be fine.

I was planning to just add another @ sign but apparently that is a no-no.

Dashrender

@BRRABill said:

@Dashrender said:

Is there a real difference? A meaningful difference?

My point is that just adding a capital or symbol adds a lot of complexity to the password. It can make a big difference when dealing with shorter passwords. (Say 12 or less.) Why totally take them out of the equation? Especially at the beginning or end of the passphrase? Or on sites that don't allow longer passwords for whatever reason.

No one ever said take them out.. just that they aren't a requirement.

the general belief is that the more requirements you put on users, the more they will fight you. So do 12+ and have no requirements - you can suggest that they put in caps, numbers, special characters.. but not required.

BRRABill

@Dashrender said:

No one ever said take them out.. just that they aren't a requirement.

the general belief is that the more requirements you put on users, the more they will fight you. So do 12+ and have no requirements - you can suggest that they put in caps, numbers, special characters.. but not required.

Got it.

I'm glad you and I had this little discussion!

larsen161

@JaredBusch said:

12+ Characters, complexity not needed. 180+ day password cycle.

2FA is always nice, but I would never expect to get it going in a standard office environment.

why would you never expect to get it going in an office?
It's been a straightforward implementation process in all of my last 3 companies.

Dashrender

@larsen161
I won't speak for JB, but for me - it's all around cost.

scottalanmiller

@Dashrender said:

@larsen161
I won't speak for JB, but for me - it's all around cost.

But you can do that for free.

scottalanmiller

@Dashrender said:

@BRRABill said:

@Dashrender said:

Is there a real difference? A meaningful difference?

My point is that just adding a capital or symbol adds a lot of complexity to the password. It can make a big difference when dealing with shorter passwords. (Say 12 or less.) Why totally take them out of the equation? Especially at the beginning or end of the passphrase? Or on sites that don't allow longer passwords for whatever reason.

No one ever said take them out.. just that they aren't a requirement.

the general belief is that the more requirements you put on users, the more they will fight you. So do 12+ and have no requirements - you can suggest that they put in caps, numbers, special characters.. but not required.

Exactly, don't block people from using them, that's totally different. You want people making long, hard, but easy for them to remember passphrases. Anything that undermines that undermines your security. So the goal is to provide more options and encouragement towards security, not introducing artificial constraints that add effort and frustration because those things work against security.

scottalanmiller

@Dashrender said:

you can suggest that they put in caps, numbers, special characters.. but not required.

I don't even know if I would do that. If those things happen naturally, great, but they literally do nothing for security, so encouraging them for their own sake is bad, even if it is just a gentle nudge. What you want most is non-repeating, long, easy to remember passphrases. Anything that doesn't encourage that isn't useful.

scottalanmiller

@BRRABill said:

My point is that just adding a capital or symbol adds a lot of complexity to the password. It can make a big difference when dealing with shorter passwords.

They don't, though. They add no complexity. They are "just another ASCII character", they are not a thing. The computer does not even know that you thought you added complexity. To the computer there are two kinds of complexity only: length and "not available in a dictionary", the dictionary meaning any list of things, not a dictionary book. A dictionary could include "list of common passwords", for example.

scottalanmiller

@BRRABill said:

thisisalongpassword = 607 million years

thisisalongpasswor@ = 3 trillion years

How is that calculated? that's not based on math alone, those two are literally identical. That has to be based on a dictionary attack, if so, it's not the @ sign that does it.

scottalanmiller

@BRRABill said:

@travisdh1 said:

Length matters, everything else is a flying spaghetti monster. If you really want to know why, you've got a LOT of reading to do, and probably more math than you've ever wanted to understand, let alone do.

I also agree with that.

I am just saying isn't

thisisalongpassword

weaker than

thisisa@longpassword

No, not weaker from a brute force attack. The thing that makes it weaker is that you used all common English words. Change that to gibberish, which is what you did in the second example, and it becomes a non-dictionary attack. That's the different, not the @ symbol.

To a computer password and p@ssw0rd are identically hard. Both words.
To a computer aosnmwen and D*n^63ed are identically hard. Both gibberish.

Length and gibberish vs. words are what matters. But length trumps gibberish dramatically, so you encourage length not gibberish. But replacing a with @, for example as people do, isn't gibberish, it does nothing.