5 ms·

Could someone explain how these passwords are secure? Given that some phrases are all lower-case letters with a single punctuation character, aren't they vulner

Could someone explain how these passwords are secure? Given that some phrases are all lower-case letters with a single punctuation character, aren't they vulnerable to brute-force attacks? My understanding has been that stronger passwords use a wide range of character options: lower-case, upper-case, punctuation, special chars. So, #RedBum72! would be more secure than abigredbum despite each having 11 chars. Is it simply the length of these passwords that makes them secure?

aaronsnoswell 12y ago
Yes - the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it. Mixing different characters into passwords is a technique to limit the effectiveness of dictionary attacks against that password. Both techniques should ideally be combined for really strong passwords, but length alone is a good place to start.
- dietrichepp 12y ago
  > the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it This is incorrect. The time (or resources, in general) required to perform a brute force attack grows exponentially as the length of a password increases. For example, let's say you use lower-case letters only, but choose them uniformly at random. If it takes an attacker one day to crack your password now, then adding a single letter means that it takes the same attacker 26 days, and adding 4 letters makes it so the same attack would take over 1,000 years.
dietrichepp 12y ago
I think you have a misunderstanding of the mathematics behind password security. If I choose lower-case letters only, then the password can have about 4.7 bits of entropy per letter, so a 16-character password would have about 75 bits, maximum. If I choose from the entire set of non-control ASCII characters, I get about 6.6 bits of entropy per letter, which means that I can get 78 bits of entropy with only 12 characters. The difficulty of a brute force attack is proportional to the number of possible passwords. So, you can make brute force attacks harder by using longer passwords, or you can use a wider range of characters. Strictly speaking, there is no need to do both, since either option gives you the exact same benefit. The technique demonstrated in the article is significantly more complex, because the letters in the passwords are not chosen uniformly, but they are chosen to form words that fit the surrounding context according to a certain kind of statistical model (a Markov chain). This makes it harder to calculate how many bits of entropy is in the password, but the bijection shown in the article makes it much easier—when you have a bijection, you are neither creating nor destroying entropy, so we know that passwords selected uniformly from the right column (such as "buill to Sound thand exp") have the exact same entropy as passwords selected uniformly from the left column (such as "0fe5c363d354d7").
- ternaryoperator 12y ago
  Thank you. That's very clear. Much appreciated!

aaronsnoswell 12y ago

Yes - the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it. Mixing different characters into passwords is a technique to limit the effectiveness of dictionary attacks against that password. Both techniques should ideally be combined for really strong passwords, but length alone is a good place to start.

dietrichepp 12y ago
> the length of a password is approximately proportional to the time taken to perform a naive brute force attack against it This is incorrect. The time (or resources, in general) required to perform a brute force attack grows exponentially as the length of a password increases. For example, let's say you use lower-case letters only, but choose them uniformly at random. If it takes an attacker one day to crack your password now, then adding a single letter means that it takes the same attacker 26 days, and adding 4 letters makes it so the same attack would take over 1,000 years.

dietrichepp 12y ago

I think you have a misunderstanding of the mathematics behind password security. If I choose lower-case letters only, then the password can have about 4.7 bits of entropy per letter, so a 16-character password would have about 75 bits, maximum. If I choose from the entire set of non-control ASCII characters, I get about 6.6 bits of entropy per letter, which means that I can get 78 bits of entropy with only 12 characters. The difficulty of a brute force attack is proportional to the number of possible passwords. So, you can make brute force attacks harder by using longer passwords, or you can use a wider range of characters. Strictly speaking, there is no need to do both, since either option gives you the exact same benefit. The technique demonstrated in the article is significantly more complex, because the letters in the passwords are not chosen uniformly, but they are chosen to form words that fit the surrounding context according to a certain kind of statistical model (a Markov chain). This makes it harder to calculate how many bits of entropy is in the password, but the bijection shown in the article makes it much easier—when you have a bijection, you are neither creating nor destroying entropy, so we know that passwords selected uniformly from the right column (such as "buill to Sound thand exp") have the exact same entropy as passwords selected uniformly from the left column (such as "0fe5c363d354d7").

ternaryoperator 12y ago
Thank you. That's very clear. Much appreciated!