This question already has an answer here:
I have a question slightly similar to this question. I am familiar with the
correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain that remembers songlyrics very easily.
Now, I am wondering how long a passphrase made up of songlyrics should be at least, to provide "acceptable" security level comparable to the 44 Bits of
correct horse battery staple. The tricky part is the social-engineering part of the question. If I google the lyrics beforehand, like one answer mentioned here, I know I am not covering up my trails. But, like I mentioned before, I know many song lyrics by heart and do not need to look them up before setteling for a passphrase. Would that do me good?
In essence, my question is asked with the assumption that a hacker social-engineered my fondness of pass-lyrics. In case that is a known fact for an attacker, how long should pass-lyrics be and would it also be a self-inflicted wound to use song-lyrics including numbers? I guess the latter part will definitely make it easier, for social-engineered attacks, yet harder for brute force.
I am well aware of the vagueness of my question, but all I am looking for is a basic rule of thumb. Right now, I am using pass-lyrics for rather low-risk accounts, but I am trying to think of something and the
correct horse battery staple is not ideal for my stupid-ass brain.
Eidt: I do not think it to be a duplicate of that BBC question in question, since I am considering whole lines of lyrics instead of first letters and as one asewer pointed out, 7 letters cover 65% of the language with the first letters of words.