5 ms·

You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which wil

by wahsd 12y ago

You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. The point being that, although not impossible, it is far more complicated to break the code than you describe here. You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..

agwa 12y ago
> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card. I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it. > You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent.. True, but there are only a handful of logical choices for any given site. In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."