Can using very long, complex passwords with online accounts be detrimental? [duplicate]

Question

In the case of data breach, long, complex passwords may draw more attention than simpler ones and the attacker might prioritize accounts with the most sophisticated passwords . Given that "it is generally accepted that 128- bit of entropy is beyond anyone's capability to brute-force", very complex passphares most likely won't provide additional security, but is there a reason to believe such passwords can even be dangerous to use?

---

.7¬£É6wÈ7%$»ª-$¢EÁº.¢vcnK=L´=sís(:ã^¤íñþp_}01çxfè§ä¬zAý¦jþ²¨¨ä`BÁ!A´Ú;çO5ý{ªõtqvuÄÃyJh6r5×ÓôJ¾/^:'Þkã+ìÃÔ«^Ôdf¡bSÞÃÆ1îP;K§IëüèEfrNÑvÛ]4ÁC¨Â{TaqÑ?û~ÑZ¼XÍSñiêkæ`úñ0CÃ?Ť^-ÞéBÊoó·*|èhýþKîzô¤³MCyªaúïÐæW,¦¾Ë"æmUò\3³CZ'!Õ¿¡6õ´[Å^7UÂùð8WW\ÇÎ߸÷O$YýyqîHY-×±T÷ù;V±Çͤöò0Vp9ñþü3Ä7·OhöP/õ6sãuI<£è5eebë¬ÔgUÑÕã~DN0f>çÃþL¥²¦`êäS[d;PÂ~[ZóÇ/aÀÃ!þÚåÔ£r@#`\´Z(h(½BàæÎ_¦¸-ÅÒcâhA+iAç÷×éê,'ºL}³ãm ·~9P¼¦hõkSìE'Á}-aoucõ¨Æ¯X¶6±¬tû¸=bg?êàòálqµ\í 2Õx:µ¾;AþTËÛë¬É«g<äúÈlõby=¾Uc×çBÙg!ÅTß+ç2K3ÛÌÄ6MY4]¡êùÒÝ´ôþ÷/k~T.>ó}¹jÉú0ï+¶

a complex 500-character password

Answer 1

In your example no. Most sites use password based key algorithms which are a form of hash function that takes as input the plaintext string (the actual password). The result from this functions is commonly a fixed length string output (can vary with sha3) and so any attacker looking at the stored passwords sees the same length regardless of actual length of original string.

Answer 2

Can using very long, complex passwords with online accounts be detrimental?

I'm certain that the example password above would survive any dictionary attack out there, as well as delay success of brute-forcing for quite some time. However, it is not very user friendly and would have to be written down somewhere in either electronic or physical form.

Both of which have weaknesses. Writing it down is prone to human error while electronic form on a device connected to the internet is prone to theft remotely. Of course both can also be stolen by hand...

So to answer your question, yes it can be detrimental. While it strengthens one security aspect, it completely fails on the other.

P.S. Agree with the answers above regarding hashing, 1 char or 500 chars password would provide same length hash string.

Answer 3

all passwords are hashed, so the attacker sees the same length. Bear in mind, that if a password is brute forced, the attacker will get the 1st password with the same hash, which is almost certainly not the 500 character password. if there is a 128bit hash, there must exist a password with around on average 16 characters with that hash, so these extra characters frankly provide no extra security. Dangerous - no, from a pure computational perspective.