I have seen many questions concerning passwords: how to measure password strength, why don't we pick passwords for the users and obviously the best one: passwords vs phrases and the one i would like to focus on a bit more.
Something I have never understood is, if you create a pass phrase, what ever it may be. lets say: ILoveAskingUselessQuestions (or even separate by spaces) or a password: 1L@UQ, now I get that that the password is shorter so easier to brute force. If it wasn't for brute force the password would be harder to obtain.
But we do live in a world with brute force therefor (with increasing computer speed) the shorter something is the more insecure it becomes.
I would argue a pass phrase is always the best thing to use. obviously with pass phrases you would get a similar trend as with passwords some phrases would show up more than others. Now obviously there are ways to prevent this and ways to check for this so it should not be a real issue.
If people were to use something personal in their pass phrases no attacker would ever be able to gain passwords (if password hashing schemes are done properly). You could argue attackers would make a list of words and try every combination but such a list would be language specific (an English attacker would never get a dutch password that way).
So my question is, why don't we make it easier for users and demand pass phrases, they are allowed to use base64 symbols and the length should be at least... 20? (that number could probably be better if someone with knowledge (not me xD) made some calculations).
and to help the users in creating good pass phrases (or explaining what it is) someone like Bruce Schneier (or anyone you'd like, why not make it a peer reviewed effort) makes a good simple to read post about it and we all link to it during account/password creation.
everything fixed, or is it not that simple?