Phrozenflame500 said:
have a longass password with tons of symbols and numbers
I want to address this bit because it's a common misconception - no, this does not make your password any more secure than just using "This is my password and it's very, very hard." as your password. In fact, the difference between that and "wah1~b51-81jn!rh1g23r180#5124@5b8" is that the former one is way more secure - by orders of magnitude, in fact. The reason is that there are mostly a limited number of ways to "break in" an account, mostly it comes to these:
- Your password is stolen (phishing, keyloggers, snooping, whatever) - your password is absolutely irrelevant at that point, even if you use "password" it's going to be the same effective strength as a gibberish of symbols. Suffice to say is that just protecting your password is how to counter it, not do anything fancy with the password.
- Somebody is watching you type your password. OK, here a bunch of gibberish helps, but what helps more is to just cover the keyboard with your hand or body. At any rate, long passwords would tend to confuse your peeping friend but seriously, you shouldn't base your password strength based on that, just don't let them see it
- The password is being guessed. Welp, do you really think people would go for "This is my password and it's very, very hard." - it's not likely. Not to mention it has a capital letter, spaces, and punctuation. Most guesses would be for "password", "password123", your pet/relative/loved one name (maybe with a relevant number, like age or year attached to it) or at most something else that's personal (address, favourite show - this kind of stuff). And if those don't work, very, very rarely, if at all, would people try anything further. Heck, a lot would stop after trying 2-3 times and would probably look for a different way.
- The password is being brute forced - bad news is, it's like "being guessed" but on crack. For the record, brute forcing a password is letting a computer automatically try passwords for you - they can go as high as five digits a minute and more. And since it's a machine it won't tire and would be as thorough as possible - it would try "password", it would try "wordpass", it would try "passw0rd", "p455w0rd", etc, as well as all other known popular passwords and their variations (symbol substitution, swapping, and appending) and after that it can just straight up jump into all symbol variations, too. The good news is that it's very, very slow, in fact. The more symbols your password has, the more time it would take to be brute forced (I'm talking WAY more time). Chances are that time is mostly limited for a cracker because you are not important enough. On top of that, it's also very easy to protect against brute forcing - you don't even have to do much. Sure, I'd suggest a longer password, but most good services would have a delay between entering a password and them going "wrong" (maybe a second or so, but that's a lot) or they would limit the amount of wrong passwords you can enter or both. Indeed, Steam already does that - if you get your password wrong a couple of times, you get to fill in a CAPTCHA as well next time.
So, out of these a gibberish password would not really protect you against anything a long but easy to remember password does. A really complex password would at most cause problems if you can't recall it, it won't help with anything. To protect yourself, have a different password for any different service and make that password memorable somehow (I embed something related to the service to each) but still hard to guess, other than that the password doesn't matter as much, it's about how well you guard it.
