4 ms·

Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If yo

Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If you use 5+symbols you’re probably creating enough entropy, but you’re veering into hard to type, might as well just use gibberish territory.

mcphage 8y ago
They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?
- hyperpape 8y ago
  Most of those are covered by what I wrote. I said they’re ranges of 0-1 symbols.
  - mcphage 8y ago
    Right, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value. Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.

mcphage 8y ago

They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?

hyperpape 8y ago
Most of those are covered by what I wrote. I said they’re ranges of 0-1 symbols.
- mcphage 8y ago
  Right, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value. Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.