2010/6/29 erik quanstrom <quans...@labs.coraid.com>: >> > I don't understand why modern security systems have an upper limit on >> > passphrase length. >> >> Because people can't remember passwords, and companies don't like >> employing full-time password changers. > > i don't understand this comment. the length of a password > is only vaguely related to memorability. long english phrases > are easy to remember. unfortunately, they are also easy to > harvest automaticly, so "four score and seven years ago" might > be a bad password.
The problem is two-fold: a) Lay-people are told by all their "computer guru" friends to choose a password that is difficult to guess. Add numbers, capital letters, punctuation. Most people don't think in this sort of context, and it is difficult to remember. b) People don't regard the idea as particularly important. I know many people who routinely forget 6-8 character passwords. The length of the phrase is actually in fact tied explicitly to memory. The longer a string of characters, the more difficult it is to remember. That's just fact. You have to practice to recite a monologue; most people can't just read it once and commit it to memory. In a similar fashion, most people must either write down a password (which is dumb) or recite it for a fairly lengthy period of time to remember it. Noting that places having an upper bound on password length usually also have other password policies (like "must contain at least one of each: capital letter, lowercase letter, and number"). This either means things like initials and important dates (birthdays, anniversaries, etc) or random gibberish. People are told not to use something that can be socially engineered, so random gibberish it is. And people at large just don't get it. It's easily forgettable. When talking about symmetric cryptography, "four score and seven years ago" would probably be a great key. There is no convenient rainbow table upon which to do a hash lookup. It's sufficiently expensive to brute-force. The only thing that would give you any sort of advantage is knowing it was an english phrase and trying all of them. Misspellings, punctuation, capitalization, and the like can all throw this off. So picking something directly out of song lyrics, quotes, or a book of idioms is likely to be useless. Adding in a single period, comma, or some creative capitalization is fantastic. But we all know about passwords here. --dho > - erik > >
