30

The math may be right. Altough one could refine and complicate it as much as one would want, but it doesn't really add to the point. So I'll leave it be. Also, in pratice it is easier and might be faster to check for any random character password with a fixed length than to check unique passwords from a list. A password list with 2^43 passwords with an ...


22

Mike Ounsworth here (author of the thread you're referencing) This is a great excuse to do some back-of-the-envelope math! The factor to think about here is that when you're getting to numbers like 243, you have to start factoring in the number of hard drives, CPUs, and electricity required to store and use that data. To make math easy, let's say each of ...


10

I see some logical errors with that statement - first of all, how would you ever know it? If Joe Schmoe used a specific password in 2007 - 2009 for his Windows PC, and it was never hacked, and the machine is trashed and burned, there would be no record of it anywhere. Therefore, unless a password was hacked or published in any other way, you cannot know, and ...


4

A mixed-case alphanumeric password for lengths between 1 and 9 (inclusive) has a key space of 13,759,005,997,841,642, which is between 253 and 254. The math is a decent ballpark guess, but not a reasonable back-of-the-napkin guess. However, just because the math is wrong does not mean that conclusion is invalid. Humans are bad at passwords. We memorize ...


3

This is not unusual for core passwords. Storing them in a digital password manager means that the password manager now has a password that needs to be protected. What do you do with that? Often through a paper process like you described. This type of paper process is normal. What is unusual is the number of systems involved. A paper process works for a ...


2

Quick answer: You shouldn't bother rotating a password unless stolen. These days even the NIST has dropped its recommendation about password rotation. In short, the biggest danger for passwords is reuse. If you are exclusively using strong unique passwords then you have no reason to change it unless you know (or suspect) it has been compromised.


1

Is kutschkem's math right? What kutschkem seems to be saying is: If about 7⋅109 people chose 1000 passwords each, there would be about 243 passwords in use. This seems like a reasonable approximation: log2(1000⋅7⋅109) ≈ 42.7; round it up to 43. (I am not assessing the empirical question of how many passwords people have chosen—only verifying the ...


Only top voted, non community-wiki answers of a minimum length are eligible