case 4661 - docs: password guidance

Removed the advice to use song lyrics, quotes or poem lines (guessing tools
try those and digit-for-letter swaps first). Now: no length or character
rules; use a password manager or six dice-chosen words from the EFF long
word list; two-factor authentication.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/8.0/ayanova/docs/ay-start-login.md

@@ -22,11 +22,7 @@ The password field has an option to show your password to make it easier to ensu
 
 Click on the eye symbol to the right of the password field to show or hide the password entry.
 
-AyaNova passwords and user names are case sensitive and there are no particular rules regarding passwords but longer passwords that are easier to remember without writing down are far more secure than shorter complicated ones with a mix of symbols that are hard to remember.
+AyaNova passwords and user names are case sensitive. AyaNova has no rules about password length or which characters a password must contain; see [What is a secure password?](home-password.md#what-is-a-secure-password) for how to choose a good one.
-
-Using a mix of characters, numbers and symbols is unnecessary and outdated advice; modern security best practices emphasize simple text passwords that are easy to remember without having to write them down and as long as can be comfortably entered on your device.
-
-For example this password `to see a world in a grain of sand` is easier to remember and many orders of magnitude more secure than this password `xJ#9a$a` due to it's length.
 
 At the bottom of the login form is a link to the AyaNova website displayed as the version and copyright information for the AyaNova app.
 

docs/8.0/ayanova/docs/home-password.md

@@ -18,21 +18,14 @@ You can click on the eye icon to conceal your entry from onlookers.
 
 ### What is a secure password?
 
-#### Long, not complicated
+#### Randomly chosen
 
-Modern security industry best practices around passwords focus entirely on length and not 'complexity' and AyaNova fully supports this by allowing very lengthy passwords and not requiring any special characters.
+What makes a password hard to guess is how randomly it was chosen, not only its length. Password guessing tools try well known phrases first, such as song lyrics, movie quotes and lines from books and poems, along with common substitutions such as `0` for `o` or `1` for `i`. A long password made from a phrase you picked because it is memorable can be guessed far faster than its length suggests.
 
-For an adequate level of security ensure your password is **at minimum** 15 characters long or as long as you can comfortably remember without writing it down.
+AyaNova accepts passwords of any length and has no rules about which characters they must contain, so you can use either of these:
 
-#### Memorable
+-   **A password manager** (recommended): let it generate a long random password and remember it for you.
-
+-   **A passphrase of at least six random words**: for example roll dice to pick words from the [EFF long word list](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt). Six words chosen this way are easy to type and remember and very hard to guess, as long as the dice choose the words, not you.
-We recommend using a lengthy but easily remembered phrase as a password, for example a song lyric, movie quote or a line from a poem that is **at least** 15 characters or more of words is currently _extremely_ difficult to hack by brute force methods.
-
-There is no security advantage in modern practice to using mixed case, unusual symbols or numbers in your password as brute force hacking techniques try all enterable characters anyway and it just makes the password harder to remember.
-
-It is more secure to have a lengthy password of plain alphabet text than it is to have a shorter one with a mix of numbers and characters.
-
-For example: this password `somewhereovertherainbowskiesareblue` is far more secure than this password `Ab3#@%5` and easier to remember without writing it down.
 
 #### Impersonal