The cross-section between high volume and easy to make
- Vegan replacement products? Easier to make than animals, but low volume so it’s more expensive than it needs to be (and often in a higher tax bracket, classified as candy or whatever)
- Eggs? Needs healthy animals
- Bananas are clones of each other. Might become an issue at some point, might not. Apples, too, but there’s many more variants
- Maize, tomatoes, potatoes? Grown by the bazillion, cheap, afaik needn’t be clones of each other to get (something close enough to) the desired product
- Rice? The pre-boiled stuff is afaik around the same price as the raw product, that’s how large the volumes are
Size matters… but only to a certain point! I’ve cracked longer ones from e.g. the LinkedIn password dump for a school project
The reason this works is because they’re not random characters. People use 111111(etc.) as password (perhaps because it’s funny), repetitions of shorter passwords, a phrase that can be found on Wikipedia or elsewhere (“Maryhadalittlelamb” — for some reason people always remove the spaces, even if they write it down with spaces on paper when putting e.g. the WiFi password on a whiteboard! Drives me mad), words optionally with leet$p3ak (words are about half as random per character as random characters are, and that’s assuming people would pick entirely random words), and other predictable things
The number of characters is thus rather meaningless for the password strength, besides calculating a lower bound
I’d say:
ceil(log(2^(80))/log(26+26+10))=14characters when you use lowercase letters, uppercase letters, and digits, orceil(log(2^(80))/log(6667))=7Diceware words if I remember correctly that the dictionary contains 6667 words. Adjust to the character set or dictionary you use and the desired strengthIf you know something will use a strong password hashing function like Bcrypt or Argon2, especially if you can set a good number of rounds/memory to be used, the requirements can be relaxed but I find it easier to have a few definitely-secure passwords than to try to seek out the edge of what’s safe
When you use a TPM or HSM or whatever a given variant is called (like a smartcard), such that you can only do a limited number of attempts in the first place, a few digits may be enough for your needs (PIN code). Mobile phones and modern computers often have these, but they’re also often broken. Needs physical access though, so it again depends on what kind of threats you think are realistic for your situation
Do switch to Argon2 in LUKS, but not out of fear please. Know that your password is good based on the maths and then upgrade at leisure :)