Memes

Well yeah, if you don’t truncate the password to 12 chars how will you fit the plaintext in a memory efficient fixed latin1 CHAR column that only accepts letters, numbers, and underscores

/s

Hearsay

That defeats the brute-force attack protection…

The idea is that brute-force attackers will only check each password once, while real users will likely assume they mistyped and retype the same password.

The code isn’t complete, and has nothing to do with actually incorrect passwords.

Like the other person said, it's not meant to always fail the first time you enter any password.

It is meant to fail the first time you enter the correct password.

Salting makes rainbow tables pretty much useless, and salting has been a standard practise for a few decades now.

How does a rainbow table help here? They're more for decoding unsalted encrypted database tables, rather than for actually trying to login.

The rainbow table would have to include every four word combination. At around half a million words in the English dictionary, that's not a small number.

As another XKCD comic illustrates, it's cheaper to use a wrench.

Dictionary attacks have been around for a long time, but It's still quite strong especially if you throw in a number.

A fully random 8 character password has about 10^14 brute force combinations (assuming upper and lower case + the normal special characters). 4 words choosen at random from the top 3000 words (which is a very small vocabulary really) is 10^13 dictionary attack combinations, add a single number or account for variations in word style (I.e maybe don't always use camel case) and you've matched the difficulty. If you use 5 words it's 10^17 combinations.

A password manager and a hard password is a better idea but there are cases where you can't use a password manager (like the password to said manager).

Amateur! Strong enough passwords are like:

ÕÚüd¸2stb½õ~jëv×Â/oyÓh²î´t¶»Ö°ÍðoNVRïé2Wc4'H,CâÞó_ökÅ,Kð¡X9ÄÀ.þTØÓoæ73d*ëÞ¢?²i"`צeÉçß,ÎÅëüS.¹([)ãÒÑêf9÷¿¢=@Á×ÅQÎÂßu¸Å(iRZµîw&ãR