4 ms·

As one of the tweets pointed out all those words are in OSX's build in wordlist. If you KNOW its 4 concatenated dictionary words than the speed at which you can

As one of the tweets pointed out all those words are in OSX's build in wordlist. If you KNOW its 4 concatenated dictionary words than the speed at which you can crack it is basically just like brute forcing a 4 digit luggage lock. It's not wrong to use. Its wrong to codify it or enact it as policy because what a corporate security goons published "password requirements" is really just "search space reducers" For example; not wasting my time on guesses below the 8 char minimum. Thanks security guy, that saved a BUNCH of time!

slooonz 7y ago
> Thanks security guy, that saved a BUNCH of time! No it didn’t. I saved a ridiculously negligible amount of time to attackers while preventing users to pick really weak passwords.
ouid 7y ago
even with just letters there are 26 times more passwords with 8 characters than there are passwords with less than 8 characters...
e_y_ 7y ago
If you're actually using OSX's word list, each "digit" could be one of ~235886 words, which is more than 17 bits of entropy or the equivalent of 2-3 normal keyboard characters (and a lot of luggage lock tumblers). In practice few people are going to remember how to spell words like "aceanthrenequinone" correctly so the practical dictionary size is a lot smaller, but still in the tens of thousands of possible words. The xkcd comic says 44 bits for a 4-word combination of common words.
BoiledCabbage 7y ago
> Thanks security guy, that saved a BUNCH of time! No it doesn't. And that's a really important point on while length matters for complexity. Assuming upper case, lower case, digits and symbols it takes ~1% of your time to try all of the passwords of length 1-7 chars as it does to try only the passwords of exactly 8 chars.
WheelsAtLarge 7y ago
ok, thanks for the clarification. It's a big assumption but I see the problem.

slooonz 7y ago

> Thanks security guy, that saved a BUNCH of time! No it didn’t. I saved a ridiculously negligible amount of time to attackers while preventing users to pick really weak passwords.

ouid 7y ago

even with just letters there are 26 times more passwords with 8 characters than there are passwords with less than 8 characters...

e_y_ 7y ago

If you're actually using OSX's word list, each "digit" could be one of ~235886 words, which is more than 17 bits of entropy or the equivalent of 2-3 normal keyboard characters (and a lot of luggage lock tumblers). In practice few people are going to remember how to spell words like "aceanthrenequinone" correctly so the practical dictionary size is a lot smaller, but still in the tens of thousands of possible words. The xkcd comic says 44 bits for a 4-word combination of common words.

BoiledCabbage 7y ago

> Thanks security guy, that saved a BUNCH of time! No it doesn't. And that's a really important point on while length matters for complexity. Assuming upper case, lower case, digits and symbols it takes ~1% of your time to try all of the passwords of length 1-7 chars as it does to try only the passwords of exactly 8 chars.

WheelsAtLarge 7y ago

ok, thanks for the clarification. It's a big assumption but I see the problem.