Aren't passphrases kind of a bad choice for passwords? If all you are ever really guessing is the symbols that make up someones password, and you know that for example they have 4 words that make the passphrase, then you effectively only have to iterate 4 symbols with a known list of possibilities for each symbol (i.e. the dictionary).
If you compare the permutation space of a short passwords (length 7) with random characters (say ~80 potential symbols), with a long(er) password made up of 4 english words (say ~3000 potential symbols, the most commonly used english words).
character_symbols = 80
word_symbols = 3000
number_of_character_password_symbols = 7
number_of_word_password_symbols = 4
permutation_space_characters = character_symbols**number_of_character_password_symbols
permutation_space_words = word_symbols**number_of_word_password_symbols
print('%.2E' % permutation_space_characters, '%.2E' % permutation_space_words)
('2.10E+13', '8.10E+13')
The words space is four times bigger, but in the same magnitude as the short (bad) password. I'm not an expert here, so I might have stuffed it up, but it seems like passphrases shouldn't really be encouraged?
I do love the recommendation to remove time-based password expiry though.
If you compare the permutation space of a short passwords (length 7) with random characters (say ~80 potential symbols), with a long(er) password made up of 4 english words (say ~3000 potential symbols, the most commonly used english words).
The words space is four times bigger, but in the same magnitude as the short (bad) password. I'm not an expert here, so I might have stuffed it up, but it seems like passphrases shouldn't really be encouraged?I do love the recommendation to remove time-based password expiry though.