209 karma · joined January 3, 2009
High school student, interested mostly in computer science and maths.
http://nicou.org nicou92@gmail.com
o) Sequences of '-','<','>' and '+' are contracted into single instructions. E.g. "----" is replaced with a single ADD(4).
SUB(4)?
Or less likely to press any key at all?
No, that doesn't sound as cool as I expected.
First attempt: quick typing, conscious mistake.
Second attempt: quick typing, wrong password again.
Third attempt: okay, I'll type it in carefully now. Wrong password.
Fourth attempt: oh, yes, that was my Yahoo! password. Remembers password and enters it cautiously, because he/she knows that he has a maximum of 5 login attempts.
Five are enough for me. Or at most 10. 100 seem ridiculous. How often does it happen that you mistype your password 99 times and get it right on the one-hundredth, before you're tired of being shown the "wrong password" message and click the "forgot password" link?
The search space for a length n is: 2 x 26^(n/3) x 10^(n/6) x 30 x 26^(n/2) = 60 x 26^(5/6 x n) x 10^(n/6) = 60 x 10^(5/6 x n x log10(26)) x 10^(n/6) =~ 6 x 10^(1.17914n) x 10^(0.16666n) = 6 x 10^(1.34581n)
So that's about a 6 followed by 1.5n zeroes of search space for length n, approximately. Using only 100 characters of the ASCII code tables, you have a search space of 10^(2n) possible passwords, which is about n/2 orders of magnitude larger than Haddock's search space.
Disclaimer: I'm a HS student, no crypto folk, so the above might be wrong, but it's basic combinatorial stuff. And that's just theory, in practice, with just "password1", "letmein" and "123456" for a dictionary attack, you can hack into like 3% of the accounts of a site that doesn't use Haddock.
Edit: Oh, I didn't even think of this: THE WORDS ARE ALL VALID ENGLISH WORDS! That makes hacking in a lot easier.
Why can't we just be well-defined formal systems? :/