Skip to main content
deleted 7 characters in body
Source Link
Mayo
  • 6.6k
  • 9
  • 31
  • 37

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, for all practicable purposesas far as I can tell, unbreakable.

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, for all practicable purposes unbreakable.

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, as far as I can tell, unbreakable.

Source Link
Mayo
  • 6.6k
  • 9
  • 31
  • 37

The simple answer is that it is *assumed that the whitespace was unintentional." I agree fully that spaces are very useful for increasing the password's entropy BUT I think this is a very useful compromise as many people cut and paste passwords and would be frustrated if they were not able to gain access to their site.

Re the issue of password security there are too many things that web sites do wrong as far as security is concerned. The most egregious one is limiting the number of characters for a password. (Assuming the passwords are not stored in clear-text.)

The simplest way to defeat dictionary and brute force attacks is by increasing the number of characters in the password.

Even if the system doesn't allow special characters a 62 character set (lower case, UPPER CASE, 0-9) is, for all practicable purposes unbreakable with 16 characters.

1 Trillion attempts / sec (as per Snowden) times 3/4 of a billion seconds in a year. Is roughly 10^19

A 16 character password is roughly 10^30; which is, for all practicable purposes unbreakable.