12 ms·

But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about

But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about complexity as a function of brute force time.

Dylan16807 8y ago
And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.
- kakarot 8y ago
  Only if you have a sufficient length of n.
  - Dylan16807 8y ago
    You need "sufficient" n no matter what your character pool is, and knowing the character pool of a password doesn't let you reliably predict if n is sufficient.
    - kakarot 8y ago
      I wasn't making that claim.
      - Dylan16807 8y ago
        Then I have absolutely no idea what you were trying to claim in the second sentence of https://news.ycombinator.com/item?id=19304761 https://news.ycombinator.com/item?id=19304761 But we don't seem to be resolving anything so I'll just hope you have a good week.
        kakarot 8y ago
        You indirectly state that I claim "knowing the character pool of a password lets you reliably predict if n is sufficient." Please point to the part of my statement which reflects this idea.
        Dylan16807 8y ago
        "a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway" This seems to say that a small character pool, aka "n-1 containing a significant percentage of possible combinations", implies that your password is "probably already short enough to brute force". So small character pool means that "probably" the password is short/weak. I'm saying that a small character pool does not imply that a password is "probably" short/weak. And to be very clear: Using the size of the character pool to say it's "probably" weak is a form of "reliably predict[ing] if n is sufficient". What am I misreading?
        kakarot 8y ago
        > What am I misreading? > So small character pool means that "probably" the password is short/weak. I really don't know how you came to that conclusion. I never claimed any dependence between the character pool length and password length. They're obviously completely separate properties.
        Dylan16807 8y ago
        You said that if a password of length n-1 "contains a significant percentage of combinations" compared to a password with length n then "it's probably already short enough to brute force". Right? That percentage comes entirely from the character pool. So character pool -> percentage -> probably short enough to brute force. What am I reading wrong? The only assumption I made is "compared to a password with length n", because what else would you be comparing length "n-1" to. Otherwise it's a direct quote.

Dylan16807 8y ago

And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.

kakarot 8y ago
Only if you have a sufficient length of n.
- Dylan16807 8y ago
  You need "sufficient" n no matter what your character pool is, and knowing the character pool of a password doesn't let you reliably predict if n is sufficient.
  - kakarot 8y ago
    I wasn't making that claim.
    - Dylan16807 8y ago
      Then I have absolutely no idea what you were trying to claim in the second sentence of https://news.ycombinator.com/item?id=19304761 https://news.ycombinator.com/item?id=19304761 But we don't seem to be resolving anything so I'll just hope you have a good week.
      - kakarot 8y ago
        You indirectly state that I claim "knowing the character pool of a password lets you reliably predict if n is sufficient." Please point to the part of my statement which reflects this idea.
        Dylan16807 8y ago
        "a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway" This seems to say that a small character pool, aka "n-1 containing a significant percentage of possible combinations", implies that your password is "probably already short enough to brute force". So small character pool means that "probably" the password is short/weak. I'm saying that a small character pool does not imply that a password is "probably" short/weak. And to be very clear: Using the size of the character pool to say it's "probably" weak is a form of "reliably predict[ing] if n is sufficient". What am I misreading?
        kakarot 8y ago
        > What am I misreading? > So small character pool means that "probably" the password is short/weak. I really don't know how you came to that conclusion. I never claimed any dependence between the character pool length and password length. They're obviously completely separate properties.
        Dylan16807 8y ago
        You said that if a password of length n-1 "contains a significant percentage of combinations" compared to a password with length n then "it's probably already short enough to brute force". Right? That percentage comes entirely from the character pool. So character pool -> percentage -> probably short enough to brute force. What am I reading wrong? The only assumption I made is "compared to a password with length n", because what else would you be comparing length "n-1" to. Otherwise it's a direct quote.