Hacker News new | ask | show | jobs
by landa 1521 days ago
The second password can be compressed almost to nothing, whereas the first password can't be compressed at all. This to me says that the first password is a lot more secure.

https://en.wikipedia.org/wiki/Kolmogorov_complexity

1 comments

Practically speaking, why does compressibility matter in terms of password security?

Side note, in the comments the second password is being referred to the 20a password while the first password has no monicker, which validates the compressibility of 20a password

> why does compressibility matter in terms of password security?

It does not. The amount to which it can be compressed is a proxy for internal redundancy. And a 'password' with a lot of internal redundancy is easier to generate and test against the real password.

I.e., code to generate all possible 25 character and less passwords consisting of only a single repeating letter would be trivial to write, and it would not need to generate that many candidates compared to the full possible password character space. Which means password cracking tools would already try all these possibilities to score "quick wins".