Every time you write a password validator...
summary
Lightning talk notes state a concrete claim: use entropy measured in bits instead of arbitrary rules. The validator described computes entropy from character choices and word patterns, an implementation kept as Java strings for 11 years, and it treats the keyboard/charset as alphabet size 126. The surprise is practical: passphrases like correcthorsebatterystaple score far better than rule‑forced gibberish, and the simple algorithm actually reduces false rejections without improving security by obscurity.
AI-written summary · about
related talks
14mPasswords. Are. Not. Hard!
28mRandom Passwords Aren't Good Enough
25mEverything You Know About Passwords Is Wrong
26m“bluegiraffeplaysball” or Make Passwords Great Again Using zxcvbn
30mhunter2: A Symphony of Password Horror
43mPlease pass the salt: Serve up passwords with a side of entropy
30mA capital letter, a number, a special character, an emotional journey for the character, a subplot
47mYour Password Complexity Requirements are Worthless