4 ms·
Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it wo
by mnarayan01 13y ago
Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.
- mistercow 13y ago>The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure. Those do not have remotely equal entropy.
- mnarayan01 13y agoAt the byte level it does, which is presumably what the OP was talking about when saying that replacing characters with digits (uniformly) does not affect entropy.
- mistercow 13y agoMaybe, but I would hope that's not what s/he meant, because that kind of entropy is basically irrelevant to password strength.
- eterm 13y agoIs bogap a dictionary word? What I'm describing are passwords like T1g3rF33t Cam3lT03 etc. All dictionary stuff along a theme, but made "secure" by applying a zero-entropy substitution of all occurrences of (L,O,A,E) with (1,0,4,3). Given that crackers know people do this, they add them to their dictionary attack routines so this is no more secure. Given I'm still fighting with them over, "don't store passwords plain text" I've not even begun to attack them over this practice yet.
- mnarayan01 13y agoHa no...I just randomly typed in symbols. Guess it does look kind of "wordish" though.