Hacker News new | past | comments | ask | show | jobs | submit login

I cannot conceive of any situation that would make a 64 character password necessary. Even 256 bits of random data can be encoded into less than 42 printable ASCII characters.

And even that is twice as much as would ever seem necessary.




Why 64 characters? Because 128 would be too much...

Seriously though, I like obnoxiously long passwords because it clues me in to who is storing my password in a manner than can be reverted to plain text if not in plaintext directly. If you're using a salted hash to store my password it shouldn't make a difference whether my password is "HN/2020/Jun!" or the full text of War and Peace -- just the hash will be stored. Anyone who tells me my password is too long makes me nervous because they are doing something different.

And of course I'm a little paranoid: how many breach datasets are your credentials in?


> I cannot conceive of any situation that would make a 64 character password necessary

Password for a streaming service that you want to use on your smart TV/Roku/Fire TV/Apple TV/Cable box.

Ideally, they provide some way so you do not have to type your password using a crappy onscreen keyboard and the up/down/left/right/enter keys on your remote. For example, I've seen some that tell you a simple URL (https://<comany_name>/add_device, say) and show you numeric code. You go to that site on your computer, log in to your account, and then enter the code from your device. Your password manager deals with the password.

Sadly, some do not do this, and you find yourself entering your password via the remote and on screen keyboard. Every time your password has a change between {upper case letter, lower case letter, number, punctuation} you have to navigate to some kind of shift key and hit it.

I do not want to try to enter some password like "sW3/W4Bmbx=Md%" that way.

An alternative might be a password that consists of 4 groups of 16 lower case letters, with no duplicate letters within a group, with the first and third groups sorted so the letters are encountered in this order: qwertyuioplkjhgfdsazxcvbnm [1]. The second and fourth groups are sorted using the reverse of that order.

That gives you a 64 character all lower case letter password that can be entered by starting at 'q' and then scanning across the keyboard back and forth, row by row, hitting enter when you come to the characters that are part of the password. It has about the same entropy as "sW3/W4Bmbx=Md%" but might be less frustrating to type. Most of the time entering it you are only having to deal with two remote keys. The arrow for the direction of your scan on the current keyboard row and enter, with just an occasional up/down to move between rows.

(If it is a smart TV or cable box, there is a decent chance the remote includes a numeric keypad. In that case I'd consider a 27 character all digit password, if I wanted something with about the same entropy as "sW3/W4Bmbx=Md%").

[1] assuming the on screen keyboard is QWERTY. Some use alphabetical order.


Do you see a reason to forbid it?


If the customer wants to do it why should the institution care?


pass phrases, where each word is relatively low entropy, but its a lot easier for humans to memorize a long phrase than a long series of random characters




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: