Hacker News Reader

Comment by aspensmonster | Hacker News Reader

I'd suspect it's a problem for people who think that, since it uses $fancy_encryption_scheme_they_cant_pronounce_or_understand, they can just use a trivially easy password for a computer to guess. Utilizing encryption isn't helpful if your password is still just "password1". I'm not a cryptographer by any means, but my general understanding is that longer is better. Picking some random nonsense sentence like "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1".

View on HN

There are multiple password cracking techniques. Under brute force longer is strictly better. However, there are sophisticated dictionary attack programs that are also seeded with leaked password lists and do a variety of clever substitutions to come up with many potential candidates from each base word. For that type of attack, a password like: passwordpasswordpasswordpassword may not be a great bet despite it's length.

However, I'd assume a password like:

thisisthepasswordthatiwilluseonhackernews

would still be relatively hard to crack?

Not if they run through a dictionary of common words and include the site name in that dictionary. (Common practice)

The search space grows exponentially with each additional word being added. With enough words, it gets infeasible to bruteforce.

@rorrr: You've been hellbanned for almost a month.

------------

His comment:

> It's nearly identical.

> There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell).

> Number of 4-word combinations:

    170,000^4 = 8.35 * 10^20

> Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters

   98^10 = 8.17 * 10^19

> An order of magnitude difference.

> And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically:

    5,000^4 = 6.25 * 10^14

    10,000^4 = 10^16

> So unless you use very obscure words in your password, you are doing much worse than you think.

Well 2^48 ~= 2.8 x 10^14, so it's not as bad as you think for the simple words version (which is the same as 8 characters chosen from 64 choices)

> You've been hellbanned for almost a month

For good reason; please check someone's comment history before advising them of this.

Reply on news.ycombinator.com