8 ms·

I'm confused about how that has anything to do with disproving my conjecture that whether whether providing your length is a tangible security leak or not is es

I'm confused about how that has anything to do with disproving my conjecture that whether whether providing your length is a tangible security leak or not is essentially a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway. You're just redefining what "secure" means.

Dylan16807 8y ago
I think we disagree about what a "tangible leak" is. I don't see it as tangible because it's eating into a tiny margin that you never should have counted in the first place. You do see it as tangible because it might make the attacker's job faster by several percent. And that's fine, we can have different opinions on that part. But "probably already short enough to brute force" is definitely not right. That percentage depends entirely on character set, not the length of your password. If your password is just numbers, then n-1 always has 10% as many combinations, whether your password is 5 characters long or 200. If you meant "probably already weak enough to brute force" that's not true either. Lots of passwords with mixed case and numbers and symbols are very short and pretty weak. Lots of passwords with only letters are very long and quite strong because they're made-up phrases. You can't guess the strength of a password just by knowing the percentage of [length n-1 combos] / [length n combos].
- kakarot 8y ago
  But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about complexity as a function of brute force time.
  - Dylan16807 8y ago
    And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.
    - kakarot 8y ago
      Only if you have a sufficient length of n.
      - Dylan16807 8y ago
        You need "sufficient" n no matter what your character pool is, and knowing the character pool of a password doesn't let you reliably predict if n is sufficient.
        kakarot 8y ago
        I wasn't making that claim.
        Dylan16807 8y ago
        Then I have absolutely no idea what you were trying to claim in the second sentence of https://news.ycombinator.com/item?id=19304761 https://news.ycombinator.com/item?id=19304761 But we don't seem to be resolving anything so I'll just hope you have a good week.
        kakarot 8y ago
        You indirectly state that I claim "knowing the character pool of a password lets you reliably predict if n is sufficient." Please point to the part of my statement which reflects this idea.
        Dylan16807 8y ago
        "a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway" This seems to say that a small character pool, aka "n-1 containing a significant percentage of possible combinations", implies that your password is "probably already short enough to brute force". So small character pool means that "probably" the password is short/weak. I'm saying that a small character pool does not imply that a password is "probably" short/weak. And to be very clear: Using the size of the character pool to say it's "probably" weak is a form of "reliably predict[ing] if n is sufficient". What am I misreading?

Dylan16807 8y ago

I think we disagree about what a "tangible leak" is. I don't see it as tangible because it's eating into a tiny margin that you never should have counted in the first place. You do see it as tangible because it might make the attacker's job faster by several percent. And that's fine, we can have different opinions on that part. But "probably already short enough to brute force" is definitely not right. That percentage depends entirely on character set, not the length of your password. If your password is just numbers, then n-1 always has 10% as many combinations, whether your password is 5 characters long or 200. If you meant "probably already weak enough to brute force" that's not true either. Lots of passwords with mixed case and numbers and symbols are very short and pretty weak. Lots of passwords with only letters are very long and quite strong because they're made-up phrases. You can't guess the strength of a password just by knowing the percentage of [length n-1 combos] / [length n combos].

kakarot 8y ago
But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about complexity as a function of brute force time.
- Dylan16807 8y ago
  And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.
  - kakarot 8y ago
    Only if you have a sufficient length of n.
    - Dylan16807 8y ago
      You need "sufficient" n no matter what your character pool is, and knowing the character pool of a password doesn't let you reliably predict if n is sufficient.
      - kakarot 8y ago
        I wasn't making that claim.
        Dylan16807 8y ago
        Then I have absolutely no idea what you were trying to claim in the second sentence of https://news.ycombinator.com/item?id=19304761 https://news.ycombinator.com/item?id=19304761 But we don't seem to be resolving anything so I'll just hope you have a good week.
        kakarot 8y ago
        You indirectly state that I claim "knowing the character pool of a password lets you reliably predict if n is sufficient." Please point to the part of my statement which reflects this idea.
        Dylan16807 8y ago
        "a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway" This seems to say that a small character pool, aka "n-1 containing a significant percentage of possible combinations", implies that your password is "probably already short enough to brute force". So small character pool means that "probably" the password is short/weak. I'm saying that a small character pool does not imply that a password is "probably" short/weak. And to be very clear: Using the size of the character pool to say it's "probably" weak is a form of "reliably predict[ing] if n is sufficient". What am I misreading?