Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
Novice in the area, so grain of salt (and if you can correct me where I&#x27;m wrong, that&#x27;d be great. All for learning):<p>1) I don&#x27;t think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we&#x27;re in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of those: regardless if my password is purplepenguinparade because you don&#x27;t know that I&#x27;ve artificially set parameters for my password within the existing parameters. It could be argued you could try all permutations of lowercase characters first (base 26) but then how do you know to go to 26^19 before adding more to the base?<p>1a) if the hashed passwords give away tells as to what the decoded password is like (in this case 3 words lowercase), that&#x27;d seem like a concern about the encryption moreso than the password.<p>2) The 20,000 and 40,000 part seems like a meaningless piece of trivia. What if one of the words I want to use doesn&#x27;t fall in your 20,000-40,000 word store? You&#x27;re never going to crack my password. Better go the full 171,000 or whatever it was and hope I don&#x27;t slip an extra character of the numeric, special character, upper&#x2F;lower case variety.<p>-------------<p>While I do personally use a password manager, it isn&#x27;t perfect for me either (requires loading 1Password 2x on Windows 10 for me because the first attempt does nothing, but loads on second try). I do hope more OS creators do like Apple did to better tie in with password managers and that may help alleviate some of it). So I don&#x27;t see my parents or grandparents, for example, using one.<p>That said, for the rank and file folks that are taking their security advice from the government and police departments, I think pushing for various words in sequence is much better advice than &quot;8 characters in length because it takes longer to guess than 6 characters&quot; or whatever it is that people predominantly operate under and usually ties back to something about themselves that someone with some familiarity about them could guess (if I recall, this is what happened to Sarah Palin when she was hacked shortly after being McCain&#x27;s VP nominee).