|
|
|
|
|
|
by thembones
3553 days ago
|
|
|
>My point is that 72^8 and 72^22 is an invalid comparison to determine the relative strength of those passwords. That's fair, but you're talking about directly attempting to crack as opposed to rainbow tables, which I believe was the authors intention, mapping the full key space. In this case, the exponents still hold. >Do not follow this advice on passwords. Additionally, maybe your first comment's point wasn't well articulated, since the author's work has proven true in your own tests for the passwords given, length trumps complexity. I would also argue that he doesn't say anywhere do not use complexity, he specifically points out however that banks use complexity as a mask of security while limiting length. |
|
|
"Internationalization" is 20 letters long, but it will be cracked in seconds by even a moderately sophisticated attacker. (zxcvbn gives it guesses_log10 of 4.34708)
The only way to measure password strength is to estimate the number of guesses necessary to crack the password. That means figuring out how many possible passwords could have been chosen for whatever method you are using to pick your password. In the case of "SophisticatedpwsRock!!", the method is something like: common adjective with a common transformation (capitalization), relatively common abbreviation, common noun with a common transformation, common punctuation, common punctuation. The number of possible passwords using that pattern is what you should be interested in, because that is how the attacked is going to get your password, not by trying every possible combination of characters.
For a simple example, the passwords "i like salt" and "you like pepper" should be considered equally strong (or equally weak as the case may be) since they follow the same pattern for generation. Any system of determining password strength which gives them significantly different strengths is misleading. In this case, if we followed the method the author used, we would say "you like pepper" is 26^4 times stronger, which is absurd. (zxcvbn by comparison gives them both almost the same rating: guesses_log10 of approximately 8.)
You cannot take a password picked by one method (common words) and score based on another method (characters). Passwords are only as strong as the easiest possible way to guess them. If you generate 8 random characters and they happen to spell "password", your password is still weak because it can be guessed by a much easier method than going through every combination of 8 characters.
Find the easiest way to approach guessing a password and see how many tries it would take using that method. That will give you the strength of the password. Counting characters will not.