3 ms·
That is not very precise. Given a certain length (6 words in the example), how many "common phrases" (above the threshold in you example) exists? How many "sim
by pelario 13y ago
That is not very precise. Given a certain length (6 words in the example), how many "common phrases" (above the threshold in you example) exists?
How many "simplistic substitutions" exists?
I would say that the search space is not as small as you are suggesting, even though I agree that the transformation of the example is quite simple, allowing a dictionary attack.
There is a famous example of a technique that takes only the first letter from each word of the phrase.
edit: "Schneider scheme"
https://www.schneier.com/essay-246.html https://www.schneier.com/essay-246.html
" My advice is to take a sentence and turn it into a password. Something like "This little piggy went to market" might become "tlpWENT2m". That nine-character password won't be in anyone's dictionary. Of course, don't use this one, because I've written about it. Choose your own sentence -- something personal."
- danbruc 13y agoThere is a famous example of a technique that takes only the first letter from each word of the phrase. That is the problem - people trying to break passwords use the exact same techniques. Compiling a list of ten million famous phrases is not hard. Generating a hundred commonly used variants of them is also easy. And checking one billion hashed passwords - MD5, SHA1 or SHA256 for example - takes less than one second on a current GPU.
- reedlaw 13y agoYou'd be surprised at how quickly common phrases are compromised. According to [1], a 6 word phrase, "it was the best of times", albeit unmodified, was broken in 4 seconds. A less common phrase, "You stay classy San Diego", was never compromised. So there may be some security in a combination of common phrases and modifier patterns, but I would say it's not enough for highly sensitive accounts. 1. http://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_brainwallet_passphrases/ http://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_br...