6 ms·

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of thos

WOW. I was expecting something dumb but this is next level dumb. You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Then you've just given me like 5 more rules that limit what the password can be. Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.

ot 14y ago
> You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit. Still, it is an incredibly stupid rule.
- jaybill 14y ago
  I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.
  - hahainternet 14y ago
    I don't know whether this is cool or sad. Fallout 3 passwords were trivially easy to infer from a single guess. They took extra time to reduce the ambiguity and make it easy once you understood the principle. Were you running a mod?
    - jaybill 14y ago
      I think it's probably more on the side of "sad", considering the way I did it. No mods. I wrote a little android app that you could put the words and number of correct letters each try into and it would shorten the list each time you did. After a while I figured out "the trick" and could do them in my head and didn't need the program anymore. It was a fun little programming exercise, though.
- furyofantares 14y ago
  Yeah, it's equivalent to reducing k to 24 for a specific character, not reducing it to 1. For k=65 it reduces the search space by about 64%, or 1.43 bits entropy (ln (65/24)/ ln 2). Though we know the first and last characters aren't special, so it's actually equivalent to reducing k to 18 for a single character, or 1.85 bits entropy lost by this rule and its interactions with the other rules. ... then the rule that the first and last characters can't be special reduces k from 65 to 62 for them, and the rule that no sets are allowed reduces k by 1 for every character after the first, and so on. But really, I think the bigger concern is that all of these rules mean the password will end up on a post-it note stuck to the monitor.
- homosaur 14y ago
  Ah, should have done the math. You're right, it's less impact that it seems at first.

ot 14y ago

> You're basically forcing a 7 character password since I already know one of them is one of those three special characters. Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit. Still, it is an incredibly stupid rule.

jaybill 14y ago
I'm pretty sure the password guesser I wrote to give me passwords on terminals in Fallout 3 would easily give me these passwords.
- hahainternet 14y ago
  I don't know whether this is cool or sad. Fallout 3 passwords were trivially easy to infer from a single guess. They took extra time to reduce the ambiguity and make it easy once you understood the principle. Were you running a mod?
  - jaybill 14y ago
    I think it's probably more on the side of "sad", considering the way I did it. No mods. I wrote a little android app that you could put the words and number of correct letters each try into and it would shorten the list each time you did. After a while I figured out "the trick" and could do them in my head and didn't need the program anymore. It was a fun little programming exercise, though.
furyofantares 14y ago
Yeah, it's equivalent to reducing k to 24 for a specific character, not reducing it to 1. For k=65 it reduces the search space by about 64%, or 1.43 bits entropy (ln (65/24)/ ln 2). Though we know the first and last characters aren't special, so it's actually equivalent to reducing k to 18 for a single character, or 1.85 bits entropy lost by this rule and its interactions with the other rules. ... then the rule that the first and last characters can't be special reduces k from 65 to 62 for them, and the rule that no sets are allowed reduces k by 1 for every character after the first, and so on. But really, I think the bigger concern is that all of these rules mean the password will end up on a post-it note stuck to the monitor.
homosaur 14y ago
Ah, should have done the math. You're right, it's less impact that it seems at first.