4 ms·

Ask HN: Is This a Secure Password?

3 points by modzu 4y ago

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! why or why not?

warrenm 4y ago
Steve Gibson would say[0] it's better than "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" because it's a character longer This article[1] disagrees because of the difference in bounding entropy high or low NIST[2] says the following (by way of [3]): > 4 bits - first character > 2 bits - each of next 7 characters > 5 bits - characters 9-20 > 1 bit - each character over 20 In short ... go for long passphrases whenever possible over passwords (and, of course, hope your target hashes them well!) ------------ [0] https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm [1] https://treskal.com/kha/blog/2011/08/26/how-much-entropy-in-that-password https://treskal.com/kha/blog/2011/08/26/how-much-entropy-in-... [2] https://web.archive.org/web/20040712152833/http:/csrc.nist.gov/publications/nistpubs/800-63/SP800-63v6_3_3.pdf https://web.archive.org/web/20040712152833/http:/csrc.nist.g... [3] https://blog.augustschell.com/passwords-passphrases-complexity-length-crackability-memorability-data-breaches https://blog.augustschell.com/passwords-passphrases-complexi...
- lax4ever 4y ago
  "My name is Oh and Captain Smek is awesome and anyone who does not think that is a poomp1"
night-rider 4y ago
8Ty]t4"=O7`!9RM$8SqlAhy0(H+:7Dj?7S-BOL]crNnE+|!i^Q#T3b4zG`v6dW'f@bQTPM)T;}7axj9lspY31Xf4vsr4Y@yZw"Loqy4* 'Password too long'
deleted 4y ago
[deleted]
kazinator 4y ago
It's a weak password because it has a simple description: 30 repetitions of !. This generalizes to a space which still has a simple description and is very small: the set of all strings of lengths 1 to 30 that are repetitions of an ASCII character. If we assume 95 printable ASCII characters, the entire dictionary of these strings is just 2850 entries. Repetition is one of the most obvious ways of building a longer string, and of encoding long strings of symbols in a short program.

4 ms·

Ask HN: Is This a Secure Password?

3 points by modzu 4y ago

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! why or why not?

warrenm 4y ago
Steve Gibson would say[0] it's better than "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" because it's a character longer This article[1] disagrees because of the difference in bounding entropy high or low NIST[2] says the following (by way of [3]): > 4 bits - first character > 2 bits - each of next 7 characters > 5 bits - characters 9-20 > 1 bit - each character over 20 In short ... go for long passphrases whenever possible over passwords (and, of course, hope your target hashes them well!) ------------ [0] https://www.grc.com/haystack.htm https://www.grc.com/haystack.htm [1] https://treskal.com/kha/blog/2011/08/26/how-much-entropy-in-that-password https://treskal.com/kha/blog/2011/08/26/how-much-entropy-in-... [2] https://web.archive.org/web/20040712152833/http:/csrc.nist.gov/publications/nistpubs/800-63/SP800-63v6_3_3.pdf https://web.archive.org/web/20040712152833/http:/csrc.nist.g... [3] https://blog.augustschell.com/passwords-passphrases-complexity-length-crackability-memorability-data-breaches https://blog.augustschell.com/passwords-passphrases-complexi...
- lax4ever 4y ago
  "My name is Oh and Captain Smek is awesome and anyone who does not think that is a poomp1"
night-rider 4y ago
8Ty]t4"=O7`!9RM$8SqlAhy0(H+:7Dj?7S-BOL]crNnE+|!i^Q#T3b4zG`v6dW'f@bQTPM)T;}7axj9lspY31Xf4vsr4Y@yZw"Loqy4* 'Password too long'
deleted 4y ago
[deleted]
kazinator 4y ago
It's a weak password because it has a simple description: 30 repetitions of !. This generalizes to a space which still has a simple description and is very small: the set of all strings of lengths 1 to 30 that are repetitions of an ASCII character. If we assume 95 printable ASCII characters, the entire dictionary of these strings is just 2850 entries. Repetition is one of the most obvious ways of building a longer string, and of encoding long strings of symbols in a short program.