It depends on how the password is stored / KDF used (what type of hash, salting, bcrypt, etc).
Judge for yourself if it’s an old website or old piece of software that might use (god forbid) MD5. Since one would not normally know that, I’d go with 20 (good, cryptographically) randomly generated upper/lower/digits if using a password manager, or 40ish characters passphrase if you need to remember and/or easily type it. Add some punctuation / special chars (spaces, commas, dots, paranthesis, etc) if it’s an important masterkey (ie password manager key, encrypted container, etc) and you have decent typing skills.
Some shitty sites / routers don’t accept certain special characters hence go with upper/lower/digits as standard but use longer lengths (if the shitty site allows you and doesn’t limit that too). Limits to what a password should contain and/or length limits would be a sign of lazy programming and poor password management, so treat them as unsecure from the get-go (yes, even big names like Oracle have piss-poor security or lazy implementation). Good programming nowdays shouldn’t have those limits, as user input sanitization / injection protection exists, and hash functions have a fixed length no matter what the input length is.
Also very important, don’t reuse passwords for online accounts. Hence a password manager remembering them for you. There are still websites storing passwords in plain text. You wouldn’t want your local pizza hut know or leak your email password by being hacked.
Something_Complex@lemmy.world 11 months ago
Idk exactly how accurate this is but seems valid
Image
atkion@sh.itjust.works 11 months ago
The colors on that are kinda confusing. 6tn years is yellow, but 2k years is green?
SnipingNinja@slrpnk.net 11 months ago
It seems like the designer didn’t notice the error
bnfdhfdhfd@lemmy.world 11 months ago
So those annoying as hell “6 character, lowercase and uppercase letters, special character” passwords give a full 8 minutes of protection. Good to know.
ngcbassman@sh.itjust.works 11 months ago
For 6 characters is 5 seconds. I like the idea of using passphrases that mix casing with symbols but still they look like like real words, it make easier to write them down when you need them and they can be very long, so they are quite secure, of course using a password manager to be able to manage them.
bnfdhfdhfd@lemmy.world 10 months ago
Damn, even worse than I thought. I wish someone would show this to the people who set those ridiculous password requirements.
I was glad when my work did away with monthly password changes and went with 15 characters minimum as the only requirement.
dbilitated@aussie.zone 10 months ago
I wonder if this assumes the cracker knows how long etc the password is when they start cracking.
I always make my passwords “a” because I figure they’ll start cracking attempts at 5 characters 😁
fosstulate@iusearchlinux.fyi 10 months ago
In EVE Online that’s called ‘getting underneath the guns’. 🎓
echodot@feddit.uk 11 months ago
Why is 1,000 years yellow in that graph?
If a password can’t be broke in 1,000 years it is utterly unbreakable in any effective sense of the term. No one’s going to run the program for a thousand years because even if they did it wouldn’t be relevant at the end of the process.
The_Vampire@lemmy.world 11 months ago
Well, the rate passwords can be tested at now may not always be the rate passwords can be tested at later. Computers were, at one point, growing exponentially faster in terms of processing power. There are still several emerging technologies out there that could cause significant speed-ups.
It’s certainly better to future-proof your passwords.