News for hackers. Stuff that matters.
Re:GoToMyPC has been hacked, all customer passwords reset by sandworm101 on Sunday June 19, 2016 @11:28AM (#11933272)
Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should.

There is a great scene in DoctorWho where a door password is a series of concepts (spoken mentally) that one thinks about in a particular order. Fiction, but the person writing that scene knew a thing or two about password complexity.

Re:GoToMyPC has been hacked, all customer passwords reset by hackuser on Sunday June 19, 2016 @12:48PM (#11933575)
> It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably.

They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.

Re:GoToMyPC has been hacked, all customer passwords reset by sandworm101 on Sunday June 19, 2016 @01:44PM (#11933805)
Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.
Re:GoToMyPC has been hacked, all customer passwords reset by hackuser on Sunday June 19, 2016 @07:30PM (#11935267)
That might not be true for an enemy who has access to some of your other passwords already, but assuming it is I still don't see how the strategy above increases complexity. At best, the complexity remains the same.
Re:GoToMyPC has been hacked, all customer passwords reset by girvo on Sunday June 19, 2016 @08:24PM (#11935435)
> strategy above increases complexity

It doesn't, but it does make it easier to remember :)