3 ms·
Why "avoid repetition"? Entropy does not matter in passwords. Example: aaaaaaaaaaaaB1! is a perfectly safe password. Domain of characters: letters(26x2=52) +
by nemesis_abc 9y ago
Why "avoid repetition"? Entropy does not matter in passwords.
Example: aaaaaaaaaaaaB1! is a perfectly safe password.
Domain of characters: letters(26x2=52) + digits(10) + punctuation(32) = 52+10+32 = 94. Password length: 15. So, size of the password domain: 94¹⁵
The example password is not less safe than any other password in the same domain, but it is certainly much easier to remember.
Why would the attacker assume that the pattern /[a-z]+[A-Z][0-9][:punct:]/ would be any more likely that any other pattern? Therefore, the attacker cannot assume a pattern for non-dictionary passwords. He will only be able to enumerate them using brute force, which is utterly unrealistic for a set with a cardinality of 94¹⁵.
- confounded 9y ago> Why would the attacker assume that the pattern /[a-z]+[A-Z][0-9][:punct:]/ would be any more likely that any other pattern? No need to assume —— large free and open corpora of real user passwords exist. If it is actually more likely to be used by humans, then it’s more likely to be cracked.
- lhopki01 9y agoTo prevent dictionary attacks. Any decent password cracker will use a dictionary before trying brute force attacks.
- nemesis_abc 9y agoThe example password is unlikely to be in the dictionary. I just made it up on the fly. Another example would be: 9999.9999+aaaa.aaaa+B It is not particularly hard to remember, while it forces the attacker to enumerate 94²¹ possibilities.
- daveFNbuck 9y agoIf an attacker obtains a few of your passwords, they can infer some things about how you're generating them and bring down the number of possibilities closer to the entropy of your method. If you use a high-entropy generation algorithm, no such attack is possible regardless of the information gained by the attacker.