Passwords vs. passphrases

As you noted, the problem with long passphrases is that there are so many characters to enter; and when all you see are asterisks in the password field, it's very easy to forget what you just typed and where you are in the process of entering the passphrase. (I remember testing the password length capabilities of a network switch that my employer had designed, and it took many tries to get a 63-character password entered correctly - even when using consecutive or repeating characters!)

I have often advised people to use acronyms made up from familiar phrases such as "Steelers fans are the greatest" preceded or followed by numbers such as your parents' house number or telephone exchange or area code (or your own house number or exchange or area code from 3 or 4 residences ago - not your current or immediately previous one as hackers probably have ready access to those if they have any of your personal details already.) The resulting password - "Sfatg282" for example - should be at least 8 characters long and would be much harder for any password cracker programs to guess, but this password can be remembered and entered readily by the user.

Click to read the article this is in response to.