You are an *incompetent* bad guy

Post #203,491 by ben_tilly 4/15/05 2:10:27 PM Reply	You are an incompetent bad guy The competent ones have dictionaries of a few thousand likely passwords that they try on every login first. These will crack a significant fraction of accounts if there is no strong password policy, and running through them can be done reasonably fast. Now suppose that there are 10 characters in the password, which could be upper case, lower case, or numbers. 62 possibilities. That is 6210 possible combinations or 8.39299e17. Suppose that you are trying combinations at the rate of 1 billion per second. (You aren't, your CPU doesn't go nearly that fast.) Then it will only take you 8.39299e8 seconds to run through the possibilities. So after 13 years of hard work, the odds are still** against you succeeding. Too bad the password was changed on you 12 years and 11 months ago! Only incompetent bad guys use brute force on this problem unless the set of possible passwords is very limited. Cheers, Ben I have come to believe that idealism without discipline is a quick road to disaster, while discipline without idealism is pointless. -- Aaron Ward (my brother)
Post #203,506 by Yendor 4/15/05 3:18:07 PM Reply	Granted... ...I'm not a bad guy. I'm not a security guy, either. But still, requiring "2 UC chars, 2 lc chars, and a byte of punctuation" reduces the number of possible permutations of passwords quite a bit. -YendorMike "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." - Benjamin Franklin, 1759 Historical Review of Pennsylvania
Post #203,511 by Silverlock 4/15/05 4:01:40 PM Reply	Disagree You are assuming that I am limiting the possible characters in a password given my scheme above. I submit that without the requirement of characters beyond lowercase letters, users will almost universally use only lowercase letters. So, mathematically speaking you are correct. In the real world of messy humans I think my scheme will, practically speaking, expand the number of possible passwords. ----------------------------------------- "In this world of sin and sorrow there is always something to be thankful for. As for me, I rejoice that I am not a Republican." -- H. L. Mencken Support our troops, Impeach Bush. D. D. Richards
Post #203,513 by ben_tilly 4/15/05 4:39:52 PM Reply	But not enough to be even remotely useful I have come to believe that idealism without discipline is a quick road to disaster, while discipline without idealism is pointless. -- Aaron Ward (my brother)

Welcome to IWETHEY!