4 ms·

I'd suspect it's a problem for people who think that, since it uses $fancy_encryption_scheme_they_cant_pronounce_or_understand, they can just use a trivially ea

I'd suspect it's a problem for people who think that, since it uses $fancy_encryption_scheme_they_cant_pronounce_or_understand, they can just use a trivially easy password for a computer to guess. Utilizing encryption isn't helpful if your password is still just "password1". I'm not a cryptographer by any means, but my general understanding is that longer is better. Picking some random nonsense sentence like "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1".

bradleyjg 14y ago
There are multiple password cracking techniques. Under brute force longer is strictly better. However, there are sophisticated dictionary attack programs that are also seeded with leaked password lists and do a variety of clever substitutions to come up with many potential candidates from each base word. For that type of attack, a password like: passwordpasswordpasswordpassword may not be a great bet despite it's length.
- lelandbatey 14y ago
  However, I'd assume a password like: thisisthepasswordthatiwilluseonhackernews would still be relatively hard to crack?
  - glomph 14y ago
    Not if they run through a dictionary of common words and include the site name in that dictionary. (Common practice)
    - _ikke_ 14y ago
      The search space grows exponentially with each additional word being added. With enough words, it gets infeasible to bruteforce.
rorrr 14y ago
> "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1" It's nearly identical. There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell). Number of 4-word combinations: 170,000^4 = 8.35 * 10^20 Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters 98^10 = 8.17 * 10^19 An order of magnitude difference. And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically: 5,000^4 = 6.25 * 10^14 10,000^4 = 10^16 So unless you use very obscure words in your password, you are doing much worse than you think.
pooriaazimi 14y ago
@rorrr: You've been hellbanned for almost a month. ------------ His comment: > It's nearly identical. > There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell). > Number of 4-word combinations: 170,000^4 = 8.35 * 10^20 > Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters 98^10 = 8.17 * 10^19 > An order of magnitude difference. > And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically: 5,000^4 = 6.25 * 10^14 10,000^4 = 10^16 > So unless you use very obscure words in your password, you are doing much worse than you think.
- deleted 14y ago
  [deleted]
- fryguy 14y ago
  Well 2^48 ~= 2.8 x 10^14, so it's not as bad as you think for the simple words version (which is the same as 8 characters chosen from 64 choices)
- danparsonson 14y ago
  > You've been hellbanned for almost a month For good reason; please check someone's comment history before advising them of this.

bradleyjg 14y ago

There are multiple password cracking techniques. Under brute force longer is strictly better. However, there are sophisticated dictionary attack programs that are also seeded with leaked password lists and do a variety of clever substitutions to come up with many potential candidates from each base word. For that type of attack, a password like: passwordpasswordpasswordpassword may not be a great bet despite it's length.

lelandbatey 14y ago
However, I'd assume a password like: thisisthepasswordthatiwilluseonhackernews would still be relatively hard to crack?
- glomph 14y ago
  Not if they run through a dictionary of common words and include the site name in that dictionary. (Common practice)
  - _ikke_ 14y ago
    The search space grows exponentially with each additional word being added. With enough words, it gets infeasible to bruteforce.

rorrr 14y ago

> "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1" It's nearly identical. There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell). Number of 4-word combinations: 170,000^4 = 8.35 * 10^20 Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters 98^10 = 8.17 * 10^19 An order of magnitude difference. And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically: 5,000^4 = 6.25 * 10^14 10,000^4 = 10^16 So unless you use very obscure words in your password, you are doing much worse than you think.

pooriaazimi 14y ago

@rorrr: You've been hellbanned for almost a month. ------------ His comment: > It's nearly identical. > There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell). > Number of 4-word combinations: 170,000^4 = 8.35 * 10^20 > Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters 98^10 = 8.17 * 10^19 > An order of magnitude difference. > And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically: 5,000^4 = 6.25 * 10^14 10,000^4 = 10^16 > So unless you use very obscure words in your password, you are doing much worse than you think.

deleted 14y ago
[deleted]
fryguy 14y ago
Well 2^48 ~= 2.8 x 10^14, so it's not as bad as you think for the simple words version (which is the same as 8 characters chosen from 64 choices)
danparsonson 14y ago
> You've been hellbanned for almost a month For good reason; please check someone's comment history before advising them of this.