I'm not for one minute suggesting that everyone should only use one pass-phrase everywhere.

If "think carefully about what passwords you use on what site" is too complicated for J. Random User, rather tell them something simple like "use different passwords on different sites (and a password manager)". I've had many discussions with support people in my last job where all the technical stuff that I thought might be valuable information to communicate was usually radically culled and replaced with something I felt was oversimplified. But the guys did have a point or two.

Only that it is several trillion times safer to use use 1 x 20-char phrase, than it is to use half a dozen unique 8-char passwords.

And obviously, it doesn't make a jot of difference if you allow it to be overseen or keylogged.

But 4- 6- and even 8-char minimums are so easily crackable, that they are almost pointless. They are the very epitome of 'a false sense of security'.

Don't believe the hype. The reason why all these GPU guys quote NTLM passwords as benchmarks is they're ridiculously easy. John on an AMD 1090T cracks them at between 0.7 and 28 Million a second depending on the version. Compare that to say PHPass MD5: well under 3900/s; BSD Blowfish in the same ballpark; Apache MD5 around 16k/s. At these rates (even GPUs can't significantly change the ratios), your $20 to search all 8-char passwords suddenly turn into $144,000 for a PHPass hash. 8 characters are good enough for most things even on buggy sites that disclose their hashes. Most of these hashing methods (with the notable exception of NTLM) use password stretching already so the difference between 8 and 20 characters will not be as big as you think either. Sure, the length doesn't matter if it's keylogged, the point about that was that you don't want your passphrase to too many places compromised in that case.

All I'm suggesting is that anyone who is newly implementing an authorisation mechanism should stop, think, read the research, and then be different. Make a difference. Don't just copy what were pretty iffy mechanisms when they were invented back in the '80s.

Fully agree. But that includes actually doing the math¹ before letting people use their mother's name and thinking it was more secure than an 8-character randomish password.

¹ OK, my calculation isn't quite correct but the error isn't larger that the amount I rounded the result up by anyway.