Whenever registering to diverse sites on the net, you are often forced to enter a so called "strong password", which would ideally contain both upper case letters, lower case letters, digits, and some other character like punctuation. As hard to remember as possible.

What I don't understand from a software development point of view is how these characters would make that much of a difference.

All of it seems to assume that a hacker trying to break a password would utilize so-called brute force. That is: try "A", try "B" ... "try AA" and so on. The more variations, the longer it takes to execute the brute force algorithm.

If I have a password of up to 10 capital letters A to Z plus "empty", that's 27 combinations, for a total of 27¹⁰ combinations.

As opposed to having a 10 letter password in the whole UTF8/ASCII 7 bit range, 127 combinations - 32 non-printable + 1 empty = 96, for a total of 96¹⁰ combinations.

Sure, a significant difference, astronomical even. But... if they would execute a brute force across TCP/IP they can maybe try one combination every millisecond or something, assuming great bandwidth. Worst case scenario for the 27¹⁰ scenario is then 57 days. Some 4 weeks on average. Assuming there's no big latency or packet drop for a significant lower bandwidth, in which case this isn't really feasible at all.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever... it is already too much of an obstacle. Unless they hope to get lucky on the initial bunch permutations, which can of course happen.

Assuming that brute force is actually what's used, which sounds quite unlikely to me. Instead of something else entirely: keyword logging, packet sniffing, the human factor ("Hi this is your bank please send us your password") etc etc.

So is the usefulness of this whole "strong password" thing just an urban legend, where companies force us to memorize ridiculously hard to remember passwords for no real gain? Why is the number of symbol table combinations in the password oh so important on almost any Internet site these days?

posted 10 months ago

CC BY-SA 4.0

Lundin‭

8822 reputation 36 119 1014 163