Password restrictions

Hey SE,
My password is four completely random common words. It cannot be socially engineered, and a brute force would take at least 550 years at 1,000 guesses per second.

I don't really need to add an exclamation mark, do I?

http://imgs.xkcd.com/comics/password_strength.png

Human attempts:

1st attempt: battery horse staple correct
Result: Your user name or password or captcha is incorrect.

2nd attempt: horse battery correct staple
Result: Your user name or password or captcha is incorrect.

(Brb 5 mins to look it up)
3rd attempt (impatiently): battery horse staple corect
Result: Your user name or password or captcha is incorrect.

4th attempt (getting angry now): corrcet horse battery staple
Result: Your user name or password or captcha is incorrect.

(Brb 10 mins to calm down, then each key slowly and carefully): correct horse battery staple
Result: Success!
(Depending on readability of captcha.)


Computer attempts (after buying a list of account details and a lookup table of hashes on the internet):

1st attempt: h17sod9wjjasjdhasdd97wdhdjndmdb (and AI on captcha)
Result: Success!

Quote:

---

Originally Posted by NoF2P

Computer attempts (after buying a list of account details and a lookup table of hashes on the internet):

1st attempt: h17sod9wjjasjdhasdd97wdhdjndmdb (and AI on captcha)
Result: Success!

---

If the computer has access to such a list, it doesn't really matter what your password is at all now does it -.-

I'm sorry you have so much trouble remembering four words. It's never been a problem for me, and I've been using XKCD-style passwords for three years.

Quote:

---

Originally Posted by Livilda

I'm sorry you have so much trouble remembering four words.

---

No need to apologise! I can just about about manage four words, but not with a different password for every account... :(

My real problem is trying along pasword in a hury wiutoit a single errror.