For real? Wow. I can't think of a good enough reason to ask anyone for their personal email password in an interview. In an investigation, yes (Hillary Clinton, for example), but not for a job interview. Well, maybe unless you were interviewing for a government or high security position... then it might make a little bit of sense.

Hipkiss thought so^^ Did you know that many (if not most) problems in IT security stem from correct advice, which is misinterpreted? You are not alone, a lot of professionals get it wrong! I study that stuff, so for me, things might be clear. However, I think, that the article I linked above is not written in a manner which is easy to understand.

Imho, security should be easy, available, automatic and user friendly. It's hard to achieve, but it's what that sector is in dire need of!

Found it: quora.com/Which-are-more-secure-multi-word-passwo…

So a slight misunderstanding on my part.

Definitely the most important thing is entropy, then # of possibilities. People way over-complicate this. I agree with this statement:

The maths and philosophy web comic XKCD brilliantly explains that the password “CorrectHorseBatteryStable” is far more secure than “Tr0ub4dor&3”. This is because password security is based on entropy, a measure of randomness, and for every extra character you add the number of combinations increases exponentially.

BUT... CorrectHorseBatteryStable is also a terrible password. The reason being, entropy is not applied across the entire landscape of the password. "Correct" is not random, "Horse" is not random, "Battery" is not random, and "Stable" is also not random. They are all words in an English dictionary and in fact the only thing random here is the order of the words. The most important thing in any cryptosystem or password like this is that the inputs must be TRULY RANDOM. So the entropy here is essentially a factor of 4 when it could be a factor of 25 (the # of chars). That said, I think "Tr0ub4dor&3" is a terrible password as well.

I've heard a lot about making sensible passwords that people "will actually remember without writing on a sticky note." And to that I say "Well, I have the ability to remember a few truly random passwords... So if you don't sucks for you." Because I'm not sacrificing my password strength for that.