4 ms·

Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols? I agree that few are very creative with how they

by tgb 11y ago

Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols? I agree that few are very creative with how they use the digits and symbols, but in no way is this lack of creativity greater than the lack of creativity that is exercised when given no constraints. People just love to use a dictionary word or common phrase or ncc1701 as their password and call it done. 100 passwords is nothing compared to a state space of 36^8 = 2.8x10^12. Remove a million or ten if you want. I think you're strongly underestimating how large this space is. Almost any change you can imagine pushes people out of the relatively minuscule space of actually-used-passwords and into the vast barren lands of all-possible-passwords and thereby increases time taken to crack. If you think requiring a number and special character are damaging (since people just have them at the end), then how about the requirement that they have numbers and special characters that are NOT at the end? I've seen this before and it forced me to invent a new password instead of reusing one. It's technically reducing the state space, but it increases the space of passwords that are actually used. Sure, those 27% of people who actually generated a random password and then happened to get no numbers or special characters are annoyed that they have to generate a new password, but everyone else is picking better passwords.

Retric 11y ago
>Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols? After looking at lists of user passwords <yes>. User chosen passwords are generally terrible. If you want users to use secure passwords the correct solution is to generate them and send them to users. Granted, users are going to just write them down at that point.
- tgb 11y ago
  I really really think you're mistaken. I completely agree that users choose passwords from a tiny subset of the possibilities and that counting the whole state space is a nearly useless measure. But there just HAS to be more variability when users are forced to do something different. Like trying to find someone, or trying to find someone who has been disallowed from being at their home or work that day. The second person is going to be much harder to find, even if they're still really predictable and just end up at the coffee shop across the street. What lists of user passwords were you looking at? I looked through the default one used by John the Ripper (though they recommend using a larger one for any real purpose) and there were hardly any uses of punctuation at all (exceptions "iloveyou!" and "!@#$%^&*") so I can't make the least bit of conclusions. Reading the list of rules it uses to modify passwords, it prepends and appends digits and punctuation but doesn't seem to delete two characters and then replace them with 1!, or anything similar to that. (Though I'll admit to being inexpert at reading the rule formats and not understanding some). That's as close to empirical data as I've got this side of thinking about how I incorporate symbols and numbers.

by tgb 11y ago

Retric 11y ago

>Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols? After looking at lists of user passwords <yes>. User chosen passwords are generally terrible. If you want users to use secure passwords the correct solution is to generate them and send them to users. Granted, users are going to just write them down at that point.

tgb 11y ago
I really really think you're mistaken. I completely agree that users choose passwords from a tiny subset of the possibilities and that counting the whole state space is a nearly useless measure. But there just HAS to be more variability when users are forced to do something different. Like trying to find someone, or trying to find someone who has been disallowed from being at their home or work that day. The second person is going to be much harder to find, even if they're still really predictable and just end up at the coffee shop across the street. What lists of user passwords were you looking at? I looked through the default one used by John the Ripper (though they recommend using a larger one for any real purpose) and there were hardly any uses of punctuation at all (exceptions "iloveyou!" and "!@#$%^&*") so I can't make the least bit of conclusions. Reading the list of rules it uses to modify passwords, it prepends and appends digits and punctuation but doesn't seem to delete two characters and then replace them with 1!, or anything similar to that. (Though I'll admit to being inexpert at reading the rule formats and not understanding some). That's as close to empirical data as I've got this side of thinking about how I incorporate symbols and numbers.