[corresation]

They aren't contradictory. While this is, as someone else stated, a "fluff piece", neither b4#L or aaaaaaaaaaaaaaaaaaaaaaaaaaa are necessarily secure passwords. It's a gradient.

Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.

[jere]

>Having said that, does any cracker even try for something like jjjjjjjjjjjjjjjjjjjjjjjjjjj? If I were trying to brute force password, I would think that such a password would be relatively safe simply because it's such an irregular pattern.

Here's my response to that: https://news.ycombinator.com/item?id=5546741

tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.

[corresation]

tldr: I could try all repeating characters so fricking fast it would be worth it to build into a cracker.

In the context of this discussion, of course we'll all say that. Does any actual cracker program try for that, though? Not to my knowledge.

[jere]

Sorry for the back of forth here, but I'll try to make this the last comment:

Some people are using all repeating characters if they can get away with it. ESPECIALLY because articles like this keep hinting that they are decent.

It doesn't matter how small this percentage of people is. The time it takes to check against it is infinitesimal and the reward is nonzero. If I were building a cracker, I would do it and not just because it's the topic of discussion.

[corresation]

Clearly I'm not making the argument that jjjjjjjjjjjjjjjjjjjjjjjjjjj is a recommended password. Of course it isn't.

Use a long, complex password. Period.

However practically we know the history of password crackers, and while it's easy to look at specific examples given and say "Oh I would totally crack for that", in most general cases they wouldn't be cracked. On the flip side, passwords that are dictionary words following by numbers and or punctuation are cracked because they are exactly what people migrated to once complexity rules were implemented.

[DanBC]

> If I were trying to brute force password

People tend not to bruteforce passwords. People tend to use dictionary attacks. I don't know if any current wordlists include 'jjjjjjjjjjjjjjjjjjjjjjjjjjj', but it'd be easy enough to create a wordlist that is just repeated characters.