People seemed to find this "If a Password is Super-Strong Does it Matter if It's Unique" question very interesting, but it actually reminded me that the converse question is interesting, too: If you use a genuinely unique password for an online account, does the "strength" (ie. the complexity & randomness) of the password actually matter that much?
So very, very, very much advice--and for employees with "security-conscious" employers, mandatory rules--has been issued to users about the need to create "strong" passwords and how to do so. But this advice and those rules often don't take into account how and where passwords are actually used. Specifically, they completely ignore the effect on password security of the lockout & throttling mechanisms that are used by on online services, remote servers at work, and well, pretty much everywhere any responsibly-managed password and PIN authentication systems.
Let's think about a slightly-extreme scenario:
I'm setting a new password for an online account at some unnamed major U.S. bank. To create that password I decide I want to be lazy, but I also don't want to pick something that's identical (or anything close to it) to any other password I use and not idiotically common or easy to guess. So, I fire up my web browser, grab a (puesdo)randomly-selected English word from here, let's say tack on a randomly-selected digit from here, and...
Let's assume that
direful4 is completely unique and unrelated to any other password I have ever used or will ever used. Let's also assume that no attacker had any information about the password and how it was chosen. (And let's also assume that today my bank would even allow me to set such a "weak" password to begin with.)
So, keeping in mind the limitations that any decent failed log-in lockout or throttling mechanism is going to place on an attacker's speed at brute-forcing cracking on the bank's site, is using
direful4 for your bank password really significantly less secure than using, say,
Kt3w54EIsq%OinCs8@f? If so, how so?
(Tip of the cap to an excellent paper from a couple of Microsoft researchers I read a few years ago that really got me thinking about this: "Do 'Strong' Web Passwords Actually Accomplish Anything??")