5 ms·

Math tells us longer passwords are better than longer alphabets, yet I am often forced to add special characters. If I have 12 character password over an alphab

Math tells us longer passwords are better than longer alphabets, yet I am often forced to add special characters. If I have 12 character password over an alphabet of 26 characters, there are 26^12 possible passwords. If I have the choice between adding 5 special characters or increasing the length of my password by 5 characters, math says do the latter: (26 + 5)^12 = 7.88 x 10^17 < 26^(12 + 5) = 1.13 x 10^24 That's over six orders of magnitude higher. How come supposedly computer savvy people don't know the difference between x^N and N^x?

forkerenok 9y ago
Totally sympathize with your comment, but, playing devils advocate, > 26^12 = 9.542895666×10^16 You could say adding 5 special chars "cheaply" doubles (formally) the search space without affecting how many chars users have to memorize.
- pishpash 9y ago
  That's not how entropy works. Yes they've expanded the search space, but not how large the typical set is. The latter is still determined by the user's memory habits.
- waynecochran 9y ago
  Isn't that 5 more characters to memorize? I guess I don't understand.
pishpash 9y ago
Who said computer savvy people designed these? These rules are not designed for technical reasons but for security theater.
dublinben 9y ago
What makes you think that these composition rules are being set by the computer-savvy folks in the room, not box-checking bureaucrats? No engineer worth his salt would propose any of the terrible password requirements (10 char max, no pasting, etc.) featured in this article.
- WorldMaker 9y ago
  Except for the poor engineer that has to maintain password compatibility with an ancient COBOL database that was plaintext EDCDIC in the middle of a binary fixed field record file. In which case, give that engineer a drink, and then the budget to build a modern system before the whole house of cards comes tumbling down.
- briffle 9y ago
  Auditors.. Its always the damn auditors.. SOX, SAS, HIPAA, PCI, etc.. Horrible, 20 year old password requirements, that the auditor doesn't even understand, but they ask the question, because they asked it last year....
JohnStrange 9y ago
That math is only correct for randomly chosen passphrases, but the rules you criticize are for user-invented passphrases. Even just adding capitalized letters to user-invented passphrases can drastically increase their security. To be fair, there are good reasons to assume that even long user-invented passphrases are no longer secure enough against offline attacks, especially when the keystretching algorithm is nonstandard or does not even use salt.
gnopgnip 9y ago
The entropy would be(26+26+10+32) depending on what special characters by the system. That is much more comparable to a 17 character password without any numbers, special characters, or uppercase. The strength of the password depends on the possible special characters and not necessarily how many of them there are.
bluGill 9y ago
Actually adding special characters reduces the search space. Most places adding them also require them, which means for one of the 10 characters the search space is just those 5 special characters, and for another the space is just the 10 numbers, and there is still one more where the search space is just the 26 letters.
- andai 9y ago
  Yeah, I had the same thought a few days ago when I got this: {lWfcM@Ko|u?;=hcYZr > Error! > The password is too weak. A good password must contain at least one digit, one uppercase and one lowercase letter. Their requirements actually reduce the entropy here haha
- JadeNB 9y ago
  > Actually adding special characters reduces the search space. Most places adding them also require them, which means for one of the 10 characters the search space is just those 5 special characters, and for another the space is just the 10 numbers, and there is still one more where the search space is just the 26 letters. But you don't know which slot has the special character and which has the number, and that choice expands the search space again (agreed not mathematically the same as with no restrictions, but then again users don't necessarily explore the whole mathematically available space of passwords).

forkerenok 9y ago

Totally sympathize with your comment, but, playing devils advocate, > 26^12 = 9.542895666×10^16 You could say adding 5 special chars "cheaply" doubles (formally) the search space without affecting how many chars users have to memorize.

pishpash 9y ago
That's not how entropy works. Yes they've expanded the search space, but not how large the typical set is. The latter is still determined by the user's memory habits.
waynecochran 9y ago
Isn't that 5 more characters to memorize? I guess I don't understand.

pishpash 9y ago

Who said computer savvy people designed these? These rules are not designed for technical reasons but for security theater.

dublinben 9y ago

What makes you think that these composition rules are being set by the computer-savvy folks in the room, not box-checking bureaucrats? No engineer worth his salt would propose any of the terrible password requirements (10 char max, no pasting, etc.) featured in this article.

WorldMaker 9y ago
Except for the poor engineer that has to maintain password compatibility with an ancient COBOL database that was plaintext EDCDIC in the middle of a binary fixed field record file. In which case, give that engineer a drink, and then the budget to build a modern system before the whole house of cards comes tumbling down.
briffle 9y ago
Auditors.. Its always the damn auditors.. SOX, SAS, HIPAA, PCI, etc.. Horrible, 20 year old password requirements, that the auditor doesn't even understand, but they ask the question, because they asked it last year....

JohnStrange 9y ago

That math is only correct for randomly chosen passphrases, but the rules you criticize are for user-invented passphrases. Even just adding capitalized letters to user-invented passphrases can drastically increase their security. To be fair, there are good reasons to assume that even long user-invented passphrases are no longer secure enough against offline attacks, especially when the keystretching algorithm is nonstandard or does not even use salt.

gnopgnip 9y ago

The entropy would be(26+26+10+32) depending on what special characters by the system. That is much more comparable to a 17 character password without any numbers, special characters, or uppercase. The strength of the password depends on the possible special characters and not necessarily how many of them there are.

bluGill 9y ago

Actually adding special characters reduces the search space. Most places adding them also require them, which means for one of the 10 characters the search space is just those 5 special characters, and for another the space is just the 10 numbers, and there is still one more where the search space is just the 26 letters.

andai 9y ago
Yeah, I had the same thought a few days ago when I got this: {lWfcM@Ko|u?;=hcYZr > Error! > The password is too weak. A good password must contain at least one digit, one uppercase and one lowercase letter. Their requirements actually reduce the entropy here haha
JadeNB 9y ago
> Actually adding special characters reduces the search space. Most places adding them also require them, which means for one of the 10 characters the search space is just those 5 special characters, and for another the space is just the 10 numbers, and there is still one more where the search space is just the 26 letters. But you don't know which slot has the special character and which has the number, and that choice expands the search space again (agreed not mathematically the same as with no restrictions, but then again users don't necessarily explore the whole mathematically available space of passwords).