-2

I was looking for a question on recommended password length for a typical usage case for users. Say, a good password length that would guard against realistic threats, like a password cracker with an 8-GPU machine. I couldn't find a good question, although I did find some likely duplicate questions that have issues described below. Even though I feel this question can be answered well on this site, I strongly believe it'd be shot down and closed as either opinion-based or a duplicate if I don't address the issues here first.

Previously, most questions asking for a recommended password length that users should choose (like this) have been confusingly closed to this question about password length limits: How long should the password be?. Since most of the answers focus on what the administrator should put the limit at instead of what the user should choose, this seems like a case of irresponsible duplicate closures. So I want to ask a new question and not mark it as a duplicate of this question. In addition, to prevent confusion in the future, someone should probably edit the other question's title to make its purpose more clear and redirect the duplicate links to the new question.

I'm also a little concerned this could be closed as opinion-based, but it seems to meet the criteria on Stack Exchange for a constructive subjective question. Considering that there have been entire news articles and research papers discussing how easily different passwords can be cracked, this seems like a question that would inspire fact-based, detailed answers, not casual recommendations grounded on anecdotal evidence.

I would definitely keep the scope of the question narrow. It would apply mainly to the average person's Facebook or Amazon account assuming an offline attack is possible, not to the broad set of special circumstances like throwaway accounts , or accounts attacked by Anonymous.

6
  • Hi Cody - downvotes on meta actually do not mean what you think. On meta they are generally taken to mean agreement or disagreement with the premise (although a poorly written question would also get downvotes)
    – Rory Alsop Mod
    Commented Aug 25, 2017 at 17:21
  • And while we do encourage people to leave comments explaining a downvote, it is not mandatory, nor even rude. So I have edited out that final paragraph as it is just entirely wrong.
    – Rory Alsop Mod
    Commented Aug 25, 2017 at 17:22
  • @RoryAlsop Ok. I'll edit my question to clarify that. You should perhaps update the tooltip for downvotes since it does not really seem to indicate what you stated.
    – RealAnswersNotAI
    Commented Aug 25, 2017 at 17:23
  • It's not possible for mods to do that. It's in the meta.se faq though and in the drop down from the help link at the top, under security.stackexchange.com/help/whats-meta
    – Rory Alsop Mod
    Commented Aug 25, 2017 at 17:25
  • After a lot of searching, I did find an answer that covers a lot of what I'd be asking here: security.stackexchange.com/questions/69374/…
    – RealAnswersNotAI
    Commented Aug 25, 2017 at 18:50
  • @RoryAlsop You previously said that downvotes on Meta indicate disagreement with the premise. However, on the help pages it explains... "For most posts, votes reflect the perceived usefulness: well-written, well-reasoned, well-researched posts tend to get more attention and more upvotes... On posts tagged feature-request, voting indicates agreement or disagreement with the proposed change." So are "discussion" and "acceptable-question" questions judged on well-reasoned and well-researched or also on agreement with the premise? If it's the latter, is there any way to make that more clear?
    – RealAnswersNotAI
    Commented Oct 9, 2017 at 16:56

1 Answer 1

Reset to default
2

I'm a bit surprised that the huge number of posts we have on this don't cover it off sufficiently for you. They cover why longer is better than short, the pros and cons of complexity, and the need for the individual to define their risk appetite, as well as when to change passwords, monitoring tools like haveIbeenpwned, and storage of passwords.

I don't think asking a question, "what length password should I use for Facebook" would be constructive at all here, because there is still no single answer. The password length and complexity I use for Facebook is probably way longer than I expect yours is. But they are probably both appropriate for each of our needs. Which is why I'd expect a question like that to be closed as a dupe of the same one you mention above.

6
  • As far as the subjectiveness, perhaps I didn't make it clear what kind of question I had in mind. My question is basically "how strong should a password be to stand against a realistic threat like a password cracker with a 8-GPU machine" Is there a question I didn't see that addresses this? I understand that different threats have different likelihoods and many people have different risk aversions, but I don't see why this doesn't stop us from talking about typical threats and what complexities are necessary to stop each threat.
    – RealAnswersNotAI
    Commented Aug 25, 2017 at 16:37
  • Regarding closing it as a dupe "of the same one you mention above", my point here is that for years we have been closing questions about how long a user should set a password as duplicates of this question about maximum length set by an administrator, which does not seem correct at all.
    – RealAnswersNotAI
    Commented Aug 25, 2017 at 16:38
  • We have general guidance from NIST on password strength, but at the end of the day, that is for Admins to then set in policy. There is nothing to define "realistic threat" except the asker, which is why there is no single answer that is correct. I could say "always use a 32 character passphrase" - and that's likely to be secure against most of my threats for some time. But it's overkill for many, and not secure enough for some circumstances.
    – Rory Alsop Mod
    Commented Aug 25, 2017 at 17:25
  • Would a question like be any better?: "XKCD and Garter Inc recommend passwords with ~44 bits of complexity. How hard is it to crack that?".
    – RealAnswersNotAI
    Commented Aug 25, 2017 at 18:10
  • We already have posts that answer that kind of thing. And 2600 questions tagged security.stackexchange.com/questions/tagged/passwords
    – Rory Alsop Mod
    Commented Aug 25, 2017 at 18:14
  • While I agree with what your comment is implying (I did eventually find a question that more or less addressed it), I strongly disagree with your comment. It does little good just to assume the question is answered without evidence. If everyone assumed that, since we have thousands of password questions, there should be posts that already answer every simple question then we'd miss out on some valuable password questions like this one from last month: security.stackexchange.com/questions/163327/…
    – RealAnswersNotAI
    Commented Aug 26, 2017 at 0:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .