281–290 of 296 posts
Earlier quoted context omitted.
You probably don't even realise that comments like the one I replied to are somewhat insulting...
Firstly, that's irrelevant and doesn't make your actions acceptable. Secondly, indirect insults due to ignorance are more forgivable than a direct verbal attack.
Earlier quoted context omitted.
A 25% speed boost is what I would call a significant percentage. Especially at 60 characters. My statement holds up.
What you're missing is that a 59 character password (with secret length) is extremely secure, despite the even larger speed boost . If you worry about any speedup in password cracking that is less than an order of magnitude, your password was too close to failing to start with. Make your password 5% longer, which will make it at least 20x slower to crack, and then you won't have to care if "20x" gets reduced to "15x"…
Earlier quoted context omitted.
What you're missing is that a 59 character password (with secret length) is extremely secure, despite the even larger speed boost . If you worry about any speedup in password cracking that is less than an order of magnitude, your password was too close to failing to start with. Make your password 5% longer, which will make it at least 20x slower to crack, and then you won't have to care if "20x" gets reduced to "15x"…
I'm confused about how that has anything to do with disproving my conjecture that whether whether providing your length is a tangible security leak or not is essentially a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway. You're just redefining what "s…
And that's fine, we can have different opinions on that part.
But "probably already short enough to brute force" is definitely not right. That percentage depends entirely on character set, not the length of your password. If your password is just numbers, then n-1 always has 10% as many combinations, whether your password is 5 characters long or 200. If you meant "probably already weak enough to brute force" that's not true either. Lots of passwords with mixed case and numbers and symbols are very short and pretty weak. Lots of passwords with only letters are very long and quite strong because they're made-up phrases. You can't guess the strength of a password just by knowing the percentage of [length n-1 combos] / [length n combos].
Earlier quoted context omitted.
I'm confused about how that has anything to do with disproving my conjecture that whether whether providing your length is a tangible security leak or not is essentially a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway. You're just redefining what "s…
I think we disagree about what a "tangible leak" is. I don't see it as tangible because it's eating into a tiny margin that you never should have counted in the first place. You do see it as tangible because it might make the attacker's job faster by several percent. And that's fine, we can have different opinions on that part. But "probably already short enough to brute force" is definitely not right. That percentag…
Earlier quoted context omitted.
I think we disagree about what a "tangible leak" is. I don't see it as tangible because it's eating into a tiny margin that you never should have counted in the first place. You do see it as tangible because it might make the attacker's job faster by several percent. And that's fine, we can have different opinions on that part. But "probably already short enough to brute force" is definitely not right. That percentag…
But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about complexity as a function of brute force time.
Earlier quoted context omitted.
But 10% of 100 is magnitudes different from 10% of 10,000. The smaller the length, the more each percent (in terms of entropy) matters when we're talking about complexity as a function of brute force time.
And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.
Earlier quoted context omitted.
And by that metric losing 2% of 1000 is a far bigger problem than losing 10% of 100,000. I agree that length is the most important factor, I'm just saying that character pool isn't very important to final security.
Only if you have a sufficient length of n.
I once used a password which our IT department gave me and it was !'a;@,oq and at least for me it looked random enough. I had it as a root password on a server and I enabled password login for about 2 minutes because I wanted to resize some virtual hard drive or something and couldn't be logged in as a normal user and then switching with su to root because then the normal user would have open files on the file system…
columns, not rows.
Earlier quoted context omitted.
You need "sufficient" n no matter what your character pool is, and knowing the character pool of a password doesn't let you reliably predict if n is sufficient.
I wasn't making that claim.
But we don't seem to be resolving anything so I'll just hope you have a good week.