28 ms·
$^$^$^_ = crack time 26 days $^$^$^i = crack time 3 months $^$^$^z = crack time 5 years Should the result vary so widely given the arguably minor variation?
by sjwright 15y ago
$^$^$^_ = crack time 26 days
$^$^$^i = crack time 3 months
$^$^$^z = crack time 5 years
Should the result vary so widely given the arguably minor variation?
- lowe 15y ago$^$^$^_ and $^$^$^z are both recognized by zxcvbn as bruteforce regions. it reports the entropy as: n log (c) for a length-n password with symbol space c. the huge difference in crack time is because zxcvbn is using c==33 (symbols only) for $^$^$^_ and c==59 (symbols + a-z) for $^$^$^z $^$^$^i is in the middle -- 'i' is considered a dictionary match, the rest is c==59 bruteforce. the bigger problem is $^$^$^ isn't recognized as a pattern, but i'm working on ways to improve bruteforce estimation too. good example!
- rplnt 15y agoOne of the cases I tried was: notaword12 - 17 hours notawrod123 - 22 minutes With almost any not-word, really. The extra 12 is better than 123 somehow.