• Zangoose@lemmy.world
    link
    fedilink
    arrow-up
    1
    ·
    4 months ago

    That’s true but in practice it wouldn’t take 60^11 tries to break the password. Troubador is not a random string and all of the substitutions are common ( o -> 0, a ->4, etc. ). You could crack this password a lot easier with a basic dictionary + substitution brute force method.

    I’m saying this because I had an assignment that showed this in an college cybersecurity class. Part of our lesson on password strength was doing a brute force attack on passwords like the one in the top of the xkcd meme to prove they aren’t secure. Any modern laptop with an i5 or higher can probably brute force this password using something like hashcat if you left it on overnight.

    Granted, I probably wouldn’t use the xkcd one either. I’d either want another word or two or maybe a number/symbol in between each word with alternating caps or something like that. Either way it wouldn’t be much harder to remember.

    • 14th_cylon@lemm.ee
      link
      fedilink
      arrow-up
      1
      ·
      4 months ago

      Troubador is not a random string

      except it is not troubador. it is troubador, ampersand, digit.

      if you know there are exactly two additional characters and you know they are at the end of the string, the first number is really slightly bigger (like 11 times)

      once the random appendix is 3 characters or more, the second number wins

      https://www.wolframalpha.com/input?i2d=true&i=Divide[Power[2048%2C4]%2CPower[256%2C3]*Power[2%2C4]*4*500000]

      and moral of the story is: don’t use xkcd comic, however funny it is, as your guidance to computer security. yes, the comic suggestions are better than having the password on a post-it on your monitor, but this is 21st century ffs, use password wallet.

      • sus@programming.dev
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        4 months ago

        if you know there are exactly two additional characters

        this is pretty much irrelevant, as the amount of passwords with n+1 random characters is going to be exponentially higher than ones with n random characters. Any decent password cracker is going to try the 30x smaller set before doing the bigger set

        and you know they are at the end of the string

        that knowledge is worth like 2 bits at most, unless the characters are in the middle of a word which is probably even harder to remember

        if you know there are exactly two additional characters and you know they are at the end of the string, the first number is really slightly bigger (like 11 times)

        even if you assume the random characters are chosen from a large set, say 256 characters, you’d still get the 4-word one as over 50 times more. Far more likely is that it’s a regular human following one of those “you must have x numbers and y special characters” rules which would reduce it to something like 1234567890!?<^>@$%&±() which is going to be less than 30 characters

        and even if they end up roughly equal in quessing difficulty, it is still far easier to remember the 4 random words