5 ms·
It would cut entropy down by a great deal if you even simply knew how long the password was.
by cmdrfred 9y ago
It would cut entropy down by a great deal if you even simply knew how long the password was.
- wruza 9y agoI've seen a movie where a bad guy entered password and a good girl counted the number of characters: one-two-three-four-five. Then she noticed that his suit had "GREED" badge on it. Combining these two facts she succesfully hacked into his laptop and prevented some shit. Since then I started to always mix few backspaces into my passwords. Not that I'm really bad, but life is life.
- ballenf 9y agoThe backspace key on most keyboards has a very distinct sound. Not to mention it's positioning means timing will be noticeably different as well. Might be better off mixing in a few meaningless modifier keys (press Ctrl, Alt or Caps Lock).
- sigjuice 9y agoI usually type a long string of gibberish, sneak in ctrl-U at some point and then enter my actual password
- idanoeman 9y agoUnless the gibberish is the same every time, the repeated sound of your password will still be parsable from a long enough sound recording of your computer usage.
- sigjuice 9y agoThe gibberish is unlikely to ever be the same.
- jaredsohn 9y agoI think it is more accurate to say that the gibberish is unlikely to _always_ be the same. I think one can tend to create similar gibberish over time. I've worked on a system where I needed to do a new signup every time I wanted to test a feature and I've run into issues where the gibberish I entered matched an account that I had previously created.
- NeutronBoy 9y agoEveryone here has accounts in development databases named 'aaa', 'asd', 'asdf', 'qwer', 'hjkl', etc!
- BigJono 9y agoNope, mine are all oeunt, oeunth, huet, uehis, ais, etc
- PhasmaFelis 9y agoI feel like the real lesson here is "don't wear your password."
- SamReidHughes 9y agoBarely. Trying all the passwords less than N characters long is way cheaper than trying the ones that are exactly N.