4 ms·
Look at it this way. Lets say I give you 5 characters to create a password. If you use all numbers then each value can be anywhere between 0 to 9. That's only 1
by drzaiusapelord 14y ago
Look at it this way. Lets say I give you 5 characters to create a password. If you use all numbers then each value can be anywhere between 0 to 9. That's only 10 values! So that's 10 to the power of 5. That's only 100,000 permutations.
With letters, assuming standard English, you get 26 per value. Or 52 when we include case. That's a big difference. So lets say I only give you 4 lowercase characters. That's 4 to the power of 26. 456k permutations. So almost 5x more secure with less characters!
Your offline password cracker can crack numeric only passwords with ease. Heck, if you know who supplied the access point, you can narrow your search. For example I have uverse and I got a 10 number password by default, just like all uverse customers. So if you know its a uverse customer you can tell your cracker to focus on 10 digit permutations. There's only 10 billion permutations there. With 10 lowercase letters its 141 trillion.
- randomdata 14y agoSounds a lot like my bank. 5 characters of 0-9 is exactly what they validate their passwords on. Luckily that validation is done only in Javascript, so disabling the check allows you to use any password you want. That doesn't help the average person though.
- 0x0 14y agoSo you actually tricked the server into setting a password it usually wouldn't accept? Uh oh, hope they don't "fix the problem" by adding similar validation on the server side later :P
- DanBC 14y agoI would ask "Why are they still your bank?" but I know that most online banking is similarly awful.