Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

16 is a lot.

Uppercase + numbers + special characters will only give 1.3 more bits per character. 26 possibilities is 4.7 bits, so each additional lowercase letter adds enough entropy to make up for the alphabet size of 4.7/1.3=3.6 characters.

So roughly speaking, 16 lowercase letters has about the entropy of 12 characters with a larger alphabet. That seems ok to me; 12 characters is pretty decent. Certainly not laughable.

With an alphabet of 64 possible characters, you have 12lg(64)=72 bits for 12 random characters.

With an alphabet of 26 possible characters, you have 16lg(26)=75 bits for 16 random characters.

And the "random" part that allows the lg(possibilities) calculation is enabled by not allowing you to set the passwords yourself.

Of course, 75 bits only gives you about 100 billion users × apps before you start hitting birthdays—er, collisions—so hopefully they're not using the passwords as unique keys anywhere! (But why would they?)



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: