4 ms·
They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I reall
by mcphage 8y ago
They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of:
* word sym
* sym word
* word word sym
* word sym word
* sym word word
* word word word sym
* word word sym word
* word sym word word
* sym word word word
And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?
- hyperpape 8y agoMost of those are covered by what I wrote. I said they’re ranges of 0-1 symbols.
- mcphage 8y agoRight, but my point is that since the cracker doesn't know which you're going to use, they'll need to stick to broad schemas that will take a long time. It doesn't matter if you only use 1 symbol, if the cracker needs to try every combination of up to 5 symbols. And even a broad schema like you suggest—which would take a long time to complete—will have holes that would be easy to squeak through, which means even those broad schemas have minimal value. Ultimately, even a schema like "sym? word sym? word sym? word sym? word sym?" is useless. They'll have to use brute force, and that means the difficulty of cracking your password is back to being based on the length.