Timeline for Why do some websites (including Google) trim whitespaces in passwords?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 8, 2015 at 1:25 | comment | added | Steve Bennett | Not only that, if it became a common method of creating passwords, then attacks can design around it. You have an alphabet consisting of digraphs, with appropriate distributions and likely co-occurrences (eg, "st" is common, "zg" is not, "th" + "is" is fairly likely...) | |
| Apr 3, 2015 at 0:47 | comment | added | Steve Jessop | @Mayo: "it cannot succumb to a dictionary attack" -- except, as is necessarily the case with any concrete example you actually give, this one can now succumb to a dictionary attack, or rather a corpus attack, since it's part of a corpus of text. Discussing passwords, no less ;-) | |
| Apr 2, 2015 at 21:29 | comment | added | Sneftel | @thepowerofnone "The bad news is, in two and a half hours the moon will crash into the earth. The good news is, I got my Tumblr account back." | |
| Apr 2, 2015 at 17:32 | comment | added | user64266 | People should stop thinking in terms of calculations per second and start thinking in terms of physical limits: we can't really know just how fast computers will become in the future and there are many things I encrypt today which 20 years from now I would still not want to be decrypted. If we take a 25-character ASCII (95 printable character) password we get about 10^49 combinations; if we consider just the energy to merely write each combination to be only 1eV, well below the theoretical minimum, it would take 10^28 J to crack, in other words, the KE of the Moon's orbit. Futureproof. | |
| Apr 2, 2015 at 15:08 | comment | added | Code Maverick | To add to your answer, I've always used xkcd.com/936 to explain entropy to people. All this lower case, upper case, l33t speak, numbers, etc. is a joke for security. All that matters is length. Over 21 characters (since hashes are 7 characters) and you are safe. | |
| Apr 2, 2015 at 1:15 | comment | added | Mayo | True. I simplified it a bit. :-) You need to avoid dictionary attacks which can be remembered by passphrases. "This is my super secret message that only I know" becomes "thimsusemethonikn." (the first two letters of every word. First letter if there are two or less letters in the word). That should be a safe password. There's enough entropy and it cannot succumb to a dictionary attack. | |
| Apr 1, 2015 at 23:35 | comment | added | user43787 |
There's more to it than just length, though. A password like passwordpassword is probably not unbreakable just because it's 16 characters long.
|
|
| Apr 1, 2015 at 17:01 | history | edited | Mayo | CC BY-SA 3.0 |
deleted 7 characters in body
|
| Apr 1, 2015 at 16:55 | history | answered | Mayo | CC BY-SA 3.0 |