4 ms·

As others have mentioned, I don't think "l33t" is going to help you there. Remember - a dictionary attack isn't based on "THE dictionary" (Websters et al.) but

As others have mentioned, I don't think "l33t" is going to help you there. Remember - a dictionary attack isn't based on "THE dictionary" (Websters et al.) but A dictionary. If I were to write a password cracker, the first thing I would do was take a list of common passwords and "l33tify" them (trivial) to create my cracking dictionary. Of course, this is still a brute force attack, and all that entails.

kenjackson 16y ago
But your dictionary just got a LOT bigger: leetify: 1eetify 13etify 133tify 1337ify 133y!fy ... leetif/ You've added about 100 new words for that one old word. Of course you can do this programmatically, so your actual dictionary stays the same size, but your search is still 100x or more longer.
- burgerbrain 16y ago
  This isn't a hypothetical, such programs and dictionaries not only exist in the wild, but are easy to find.
  - kenjackson 16y ago
    I didn't suggest it was a hypothetical. But I wanted to be clear that its not like you double the size of a not l33tifi36 dictionary. Rather it becomes 100x larger. And depending on how many l33t variants you supports several thousand times larger.
  - cosmicray 16y ago
    th3quickbrownfoxjumpsov3rth314zydogsb4ck silly, but at least it has length going for it
rhizome 16y ago
Right, and if the argument is that adding character classes adds complexity, then the 1337ed characters are not actually a different character class, they are equal to an existing one. "e" == "3" doesn't help, even if you have a "secret scheme" (as mentioned above). "secret," "s3cr3t," and "secr3t" are all equal in complexity except with raw brute force. Which this isn't, it's just a dictionary with some extra substitutable characters.