Communities

Writing
Writing
Codidact Meta
Codidact Meta
The Great Outdoors
The Great Outdoors
Photography & Video
Photography & Video
Scientific Speculation
Scientific Speculation
Cooking
Cooking
Electrical Engineering
Electrical Engineering
Judaism
Judaism
Languages & Linguistics
Languages & Linguistics
Software Development
Software Development
Mathematics
Mathematics
Christianity
Christianity
Code Golf
Code Golf
Music
Music
Physics
Physics
Linux Systems
Linux Systems
Power Users
Power Users
Tabletop RPGs
Tabletop RPGs
Community Proposals
Community Proposals
tag:snake search within a tag
answers:0 unanswered questions
user:xxxx search by author id
score:0.5 posts with 0.5+ score
"snake oil" exact phrase
votes:4 posts with 4+ votes
created:<1w created < 1 week ago
post_type:xxxx type of post
Search help
Notifications
Mark all as read See all your notifications »
Q&A

Welcome to Software Development on Codidact!

Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.

Comments on Are "strong passwords" at all meaningful?

Parent

Are "strong passwords" at all meaningful?

+18
−0

Whenever registering to diverse sites on the net, you are often forced to enter a so called "strong password", which would ideally contain both upper case letters, lower case letters, digits, and some other character like punctuation. As hard to remember as possible.

What I don't understand from a software development point of view is how these characters would make that much of a difference.

All of it seems to assume that a hacker trying to break a password would utilize so-called brute force. That is: try "A", try "B" ... "try AA" and so on. The more variations, the longer it takes to execute the brute force algorithm.

If I have a password of up to 10 capital letters A to Z plus "empty", that's 27 combinations, for a total of 2710 combinations.

As opposed to having a 10 letter password in the whole UTF8/ASCII 7 bit range, 127 combinations - 32 non-printable + 1 empty = 96, for a total of 9610 combinations.

Sure, a significant difference, astronomical even. But... if they would execute a brute force across TCP/IP they can maybe try one combination every millisecond or something, assuming great bandwidth. Worst case scenario for the 2710 scenario is then 57 days. Some 4 weeks on average. Assuming there's no big latency or packet drop for a significant lower bandwidth, in which case this isn't really feasible at all.

I don't see anyone setting up a brute force operation for that in order to access John Doe's Gmail account or whatever... it is already too much of an obstacle. Unless they hope to get lucky on the initial bunch permutations, which can of course happen.

Assuming that brute force is actually what's used, which sounds quite unlikely to me. Instead of something else entirely: keyword logging, packet sniffing, the human factor ("Hi this is your bank please send us your password") etc etc.

So is the usefulness of this whole "strong password" thing just an urban legend, where companies force us to memorize ridiculously hard to remember passwords for no real gain? Why is the number of symbol table combinations in the password oh so important on almost any Internet site these days?

History
Why does this post require attention from curators or moderators?
You might want to add some details to your flag.
Why should this post be closed?

5 comment threads

Security theater (3 comments)
Relevant XKCD: https://xkcd.com/936/ (3 comments)
See also: SE thread "What is your way to create good passwords that can actually be remembered?" (1 comment)
I think the question becomes more interesting in the context of most popular services (and most workp... (1 comment)
Off-topic (5 comments)
Post
+8
−0

Disclaimer: I am not a security expert nor a security professional.

There is, of course, a relevant XKCD comic for this:

XKCD comic about how short passwords with special symbols and numbers are less secure and harder to remember than long passwords with only alphabetic characters

The entropy numbers appear to be accurate based on this security.stackexchange post. It actually assumes a dictionary attack, which involves checking for common words in passwords and is sometimes used to discredit the "correcthorsebatterystaple" method of password generation. However, when password checkers are looking at password strength, they usually are comparing passwords of equal lengths. An 8 character password with only alphabetic characters will be weaker than an 8 character password with digits, special symbols, and alphabetic characters. If you assume that people will use the shortest password they can get away with, then forcing them to include more variety makes sense. It also allows the site to use less database storage space while forcing better passwords than just 8 alphabetic characters.

In my personal experience, security professionals assume people will use some kind of password storage program. They don't seem to consider the difficulty of remembering the sheer number of passwords required for various necessary accounts. None of the various security seminars I have participated in for work offered any solutions. Password requirements are based on site security for that site alone; they don't take into account how users are supposed to handle 50 sites with difficult to remember passwords.

To answer your question about attacks per second: attackers aren't necessarily trying to attack over the internet. They will use copies of databases full of hashed passwords and run hundreds of attacks per second on them. Once they have a plaintext password, they can try that on other sites such as banks (people reuse passwords enough for this to be worth it). So the password strength really can matter, especially if you reuse passwords.

History
Why does this post require attention from curators or moderators?
You might want to add some details to your flag.

1 comment thread

Password managers are a consequence, not a reason (1 comment)
Password managers are a consequence, not a reason
tripleee‭ wrote 9 months ago

"Security professionals" are generally only trying to implement the minimum required hassle, but this generally means more hassle than many users will readily tolerate. However, the opposite would obviously be even worse; not enforcing the requirements would make security even worse for everyone.

Password managers have emerged as a solution because of this, not because security professionals "assume" people will use them; but now that a reasonably usable solution exists, you really should bite the bullet and start using a password manager.