4 ms·

If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n, because you share effort between the two schemes. A cracker can try all t

If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n, because you share effort between the two schemes. A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.

mcphage 8y ago
That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.
- hyperpape 8y ago
  Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If you use 5+symbols you’re probably creating enough entropy, but you’re veering into hard to type, might as well just use gibberish territory.
  - mcphage 8y ago
    They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?
    - hyperpape 8y ago
      Most of those are covered by what I wrote. I said they’re ranges of 0-1 symbols.
      - mcphage 8y ago
        Right, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value. Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.

mcphage 8y ago

That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.

hyperpape 8y ago
Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If you use 5+symbols you’re probably creating enough entropy, but you’re veering into hard to type, might as well just use gibberish territory.
- mcphage 8y ago
  They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?
  - hyperpape 8y ago
    Most of those are covered by what I wrote. I said they’re ranges of 0-1 symbols.
    - mcphage 8y ago
      Right, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value. Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.