4 ms·

> > If I use four unicode code points outside the [multi-language characters table], my password is probably very safe already. > Security through obscurity. T

> > If I use four unicode code points outside the [multi-language characters table], my password is probably very safe already. > Security through obscurity. This is safe until everyone does it. It's not a strong password by virtue of being short, it's strong because this is impossible to input and so nobody uses it and so it doesn't make sense to guess. But you bet that if you ever log into a compromised system, use a phishing page, or a site stores and loses your password in plain text, the gig is up and it's known that cracking u/alanfranz's passwords is a matter of trying a few random unicode characters instead of letters. This is plain wrong. The Basic Multilingual Plane consists of 65536 most commonly used codepoints. If your password contains a character outside of the BMP (e.g. an emoji), the attacker has to be bruteforcing over at least one other plane in addition to the BMP, which is 2*65536 characters = 17 bits of entropy per character. 4*17 = 68 bits of entropy is plenty. Even if everyone included an emoji in their passwords, this won't become any weaker.

lolinder 4y ago
Correct, but the recommendation in the article is still wrong. If I get a password that has four Unicode characters in it, it's possible that it's a strong password that chose truly randomly from the available Unicode characters, but it's much more likely that someone just picked four that they like. In the latter case, the bits per character is going to be much lower, but I can't tell the difference just looking at the password. The only good solution I can think of is to assume low bits per character and require a minimum password length.
- zinekeller 4y ago
  > but it's much more likely that someone just picked four that they like Or as I would call it, the fallacy of uniformity. The author assumes that hackers would only try a dictionary attack using lower case letters, but this is no longer true since mid-2010s. Some dictionaries geared for international services also have non-Latin characters since not all countries restrict passwords to alphanumerics.
  - alanfranz 4y ago
    If it’s four random Unicode code points, it’s not a dictionary word.
- Aeolun 4y ago
  You don’t have to assume this. You can check the length in bytes of the password.
- alanfranz 4y ago
  The same problem can happen with eight-char passwords. I could pick the same eight chars I like all the time and reuse passwords. You cannot fix password reuse that way. I'm not advocating for emoji passwords, it was just a discussion about password strength vs length.
  - lolinder 4y ago
    Right, you can't force people to use good passwords, but you can set up requirements that try to maximize the chances that that's what you get. As others have mentioned, there's no way to fully evaluate password strength short of providing your own entropy, so while the distribution is an important one to know about there's not much we can do to apply it while retaining a traditional password model. NIST has some recommendations[0] that can detect when a password is not strong, such as checking a list of cracked passwords, but we can't prove that it is. [0] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

lolinder 4y ago

Correct, but the recommendation in the article is still wrong. If I get a password that has four Unicode characters in it, it's possible that it's a strong password that chose truly randomly from the available Unicode characters, but it's much more likely that someone just picked four that they like. In the latter case, the bits per character is going to be much lower, but I can't tell the difference just looking at the password. The only good solution I can think of is to assume low bits per character and require a minimum password length.

zinekeller 4y ago
> but it's much more likely that someone just picked four that they like Or as I would call it, the fallacy of uniformity. The author assumes that hackers would only try a dictionary attack using lower case letters, but this is no longer true since mid-2010s. Some dictionaries geared for international services also have non-Latin characters since not all countries restrict passwords to alphanumerics.
- alanfranz 4y ago
  If it’s four random Unicode code points, it’s not a dictionary word.
Aeolun 4y ago
You don’t have to assume this. You can check the length in bytes of the password.
alanfranz 4y ago
The same problem can happen with eight-char passwords. I could pick the same eight chars I like all the time and reuse passwords. You cannot fix password reuse that way. I'm not advocating for emoji passwords, it was just a discussion about password strength vs length.
- lolinder 4y ago
  Right, you can't force people to use good passwords, but you can set up requirements that try to maximize the chances that that's what you get. As others have mentioned, there's no way to fully evaluate password strength short of providing your own entropy, so while the distribution is an important one to know about there's not much we can do to apply it while retaining a traditional password model. NIST has some recommendations[0] that can detect when a password is not strong, such as checking a list of cracked passwords, but we can't prove that it is. [0] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret