4 ms·

Right, but to put it simply, character count is the only metric that matters. If your password is a sentence that's 44 characters long, then you're set.

iuguy 16y ago
Almost. If your password is 44 letter 'A's long and the only supported character is 'A' then it's not. That's an extreme example, but there is a trade-off between length and complexity. As long as you bear that in mind you're fine.
DisposaBoy 16y ago
I forget the link(I think it was in a HN comment some time ago, I can't remember) but it showed that longer passwords are actually faster to crack due to hardware constraints. Besides, all this password security talk is based on the assumption that a password cracker is: 1. going to scan a range in sequence 2. it's going to do it in-order(as opposed to random) My theory on why that password would actually be more secure is that it has spaces in there. I assume most peeople interested in cracking it would probably not try passwords with spaces in them because they know that some web services don't like it(no idea why) and more importantly many(if ot most or all) strong password generators don't includes spaces by default which means most users of these generators won't have spaces in their generated passwords.
wickedchicken 16y ago
This is what the author of the original article is trying to say, apparently nobody has heard of hybrid dictionary crackers. For example, JtR has a whole set of 'mangling rules' that take words in a provided dictionary and apply various transformations (see http://www.openwall.com/john/doc/RULES.shtml http://www.openwall.com/john/doc/RULES.shtml).
anthonyb 16y ago
No, goddamnit! The search space of possible passwords is the metric that matters. This is why people should not be rolling their own password schemes. 27 possible chars * 16 length gives 27^16 combinations, or about 8.0 * 10^22 combinations. (Although much, much less in practice because you're using common english words separated by spaces.) Printable characters, including punctuation like { } | & etc, gives you 95 characters, for 4.4 * 10^31 combinations - about fifty million (50,000,000) times larger. Also, the main attack (which the article misses) happens offline, where the bad guys have compromised a system and downloaded all of the password hashes. In that case, they're only limited by the hardware that they can throw at it - FPGAs and high end graphics cards can check stupid numbers of hashes per second. http://nsa.unaligned.org/ http://nsa.unaligned.org/ is from 2007, and will check 800 passwords * 64 chars * 8 length in about a day.

iuguy 16y ago

Almost. If your password is 44 letter 'A's long and the only supported character is 'A' then it's not. That's an extreme example, but there is a trade-off between length and complexity. As long as you bear that in mind you're fine.

DisposaBoy 16y ago

I forget the link(I think it was in a HN comment some time ago, I can't remember) but it showed that longer passwords are actually faster to crack due to hardware constraints. Besides, all this password security talk is based on the assumption that a password cracker is: 1. going to scan a range in sequence 2. it's going to do it in-order(as opposed to random) My theory on why that password would actually be more secure is that it has spaces in there. I assume most peeople interested in cracking it would probably not try passwords with spaces in them because they know that some web services don't like it(no idea why) and more importantly many(if ot most or all) strong password generators don't includes spaces by default which means most users of these generators won't have spaces in their generated passwords.

wickedchicken 16y ago

This is what the author of the original article is trying to say, apparently nobody has heard of hybrid dictionary crackers. For example, JtR has a whole set of 'mangling rules' that take words in a provided dictionary and apply various transformations (see http://www.openwall.com/john/doc/RULES.shtml http://www.openwall.com/john/doc/RULES.shtml).

anthonyb 16y ago

No, goddamnit! The search space of possible passwords is the metric that matters. This is why people should not be rolling their own password schemes. 27 possible chars * 16 length gives 27^16 combinations, or about 8.0 * 10^22 combinations. (Although much, much less in practice because you're using common english words separated by spaces.) Printable characters, including punctuation like { } | & etc, gives you 95 characters, for 4.4 * 10^31 combinations - about fifty million (50,000,000) times larger. Also, the main attack (which the article misses) happens offline, where the bad guys have compromised a system and downloaded all of the password hashes. In that case, they're only limited by the hardware that they can throw at it - FPGAs and high end graphics cards can check stupid numbers of hashes per second. http://nsa.unaligned.org/ http://nsa.unaligned.org/ is from 2007, and will check 800 passwords * 64 chars * 8 length in about a day.