6 ms·

Couldn't I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?

vitno 10y ago
There are a lot more words in the dictionary than letters.
DerfK 10y ago
The question is whether people are all going to pull words from a very small pool or form sentences to cut the search space (adjective noun adverb verb noun). A search space of 2000^5 (2000 most common words without punctuation) is still about 20 times larger than 80^8 (upper/lower/number/symbols)
sandworm101 10y ago
Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should. There is a great scene in DoctorWho where a door password is a series of concepts (spoken mentally) that one thinks about in a particular order. Fiction, but the person writing that scene knew a thing or two about password complexity.
- hackuser 10y ago
  > It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.
  - sandworm101 10y ago
    Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.
    - hackuser 10y ago
      That might not be true for an enemy who has access to some of your other passwords already, but assuming it is I still don't see how the strategy above increases complexity. At best, the complexity remains the same.
      - girvo 10y ago
        > strategy above increases complexity It doesn't, but it does make it easier to remember :)
dellsystem 10y ago
The number of possible letters is much, much smaller than the number of possible dictionary words. The latter would take many orders of magnitude longer to brute force, which would make it unfeasible.
zo1 10y ago
The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,109 * 1,025,109 * 1,025,109) = A really big number. So, granted, the amount of possible words is much smaller than that. But the attacker can't know that for sure. To put the number above in scale, just 69 factorial is equivalent to 1.711224524 * 10^98.
- hackuser 10y ago
  I agree with your general point, but I have just a couple of mathematical points: > For a normal 5 letter (alpha-numeric only) password: > 36 With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100. > factorial The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/) > the amount of possible words is much smaller than that. But the attacker can't know that for sure They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.
  - zo1 10y ago
    >"The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)" You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.
    - umanwizard 10y ago
      You were probably thinking about the fact that picking, in order, 5 elements taken from a set of 1000 elements yields (1000 factorial) / (995 factorial) possible combinations.
sandworm101 10y ago
^This shouldn't be downvoted. It is a perfectly valid question.

vitno 10y ago

There are a lot more words in the dictionary than letters.

DerfK 10y ago

The question is whether people are all going to pull words from a very small pool or form sentences to cut the search space (adjective noun adverb verb noun). A search space of 2000^5 (2000 most common words without punctuation) is still about 20 times larger than 80^8 (upper/lower/number/symbols)

sandworm101 10y ago

Five or six words is a huge amount of entropy. In reality there are other rules in my example than just using words. It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. And it of a random length, having taken its length from my selection of words rather than from any fixed policy. Few services accept random lengths but imho all should. There is a great scene in DoctorWho where a door password is a series of concepts (spoken mentally) that one thinks about in a particular order. Fiction, but the person writing that scene knew a thing or two about password complexity.

hackuser 10y ago
> It starts with a capital letter and includes a conjugated verb (running) both of which increase complexity considerably. They reduce complexity: It reduces the number of possibilities on the first character, and the attacker knows that one word must be a (conjugated? present participle?) verb yet, when otherwise it could be anything.
- sandworm101 10y ago
  Those are rules in the user's head. We assume that the enemy only knows that the user is chaining words.
  - hackuser 10y ago
    That might not be true for an enemy who has access to some of your other passwords already, but assuming it is I still don't see how the strategy above increases complexity. At best, the complexity remains the same.
    - girvo 10y ago
      > strategy above increases complexity It doesn't, but it does make it easier to remember :)

dellsystem 10y ago

The number of possible letters is much, much smaller than the number of possible dictionary words. The latter would take many orders of magnitude longer to brute force, which would make it unfeasible.

zo1 10y ago

The way to compute the amount of possible brute-force combinations: For a normal 5 letter (alpha-numeric only) password: 36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations. However, for a 5-word password, the calculation is as follows: Assuming the number of possible words in the English language is 1.025109 million, then: 1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,109 * 1,025,109 * 1,025,109) = A really big number. So, granted, the amount of possible words is much smaller than that. But the attacker can't know that for sure. To put the number above in scale, just 69 factorial is equivalent to 1.711224524 * 10^98.

hackuser 10y ago
I agree with your general point, but I have just a couple of mathematical points: > For a normal 5 letter (alpha-numeric only) password: > 36 With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100. > factorial The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/) > the amount of possible words is much smaller than that. But the attacker can't know that for sure They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.
- zo1 10y ago
  >"The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)" You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.
  - umanwizard 10y ago
    You were probably thinking about the fact that picking, in order, 5 elements taken from a set of 1000 elements yields (1000 factorial) / (995 factorial) possible combinations.

sandworm101 10y ago

^This shouldn't be downvoted. It is a perfectly valid question.