My point is that 72^8 and 72^22 is an invalid comparison to determine the relative strength of those passwords.
B5s9z-Qx is 72^8
SophisticatedpwsRock!! is something like number_of_common_words^2 + 26^3 + 10^2. In other words, two common words, three lowercase letters and two symbols.
You can put each of these passwords in Dropbox's zxcvbn (https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...) to see this more clearly.
They give a guesses_log10 of 8 for "B5s9z-Qx" and 12.76155 for "SophisticatedpwsRock!!". In other words, the latter is stronger, but it's not 72^14 times stronger. That's where the article messes up.
An attacker isn't going to crack "SophisticatedpwsRock!!" by trying 72^22 options. Just like an attacker isn't going to crack "password" by trying 72^8 or even 26^8 options. They're going to try 1000 or so options of super common passwords for "password" and some combination of dictionary words, abbreviations, symbols, common transformations, etc for "SophisticatedpwsRock!!". This makes the search space much, MUCH smaller than 72^22.
B5s9z-Qx is 72^8
SophisticatedpwsRock!! is something like number_of_common_words^2 + 26^3 + 10^2. In other words, two common words, three lowercase letters and two symbols.
You can put each of these passwords in Dropbox's zxcvbn (https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.ht...) to see this more clearly.
They give a guesses_log10 of 8 for "B5s9z-Qx" and 12.76155 for "SophisticatedpwsRock!!". In other words, the latter is stronger, but it's not 72^14 times stronger. That's where the article messes up.
An attacker isn't going to crack "SophisticatedpwsRock!!" by trying 72^22 options. Just like an attacker isn't going to crack "password" by trying 72^8 or even 26^8 options. They're going to try 1000 or so options of super common passwords for "password" and some combination of dictionary words, abbreviations, symbols, common transformations, etc for "SophisticatedpwsRock!!". This makes the search space much, MUCH smaller than 72^22.