Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?

How are long passwords more secure? The only situation in which I can accept long passwords are more secure is when someone is literally standing behind you, seeing what you are typing.

When it comes to someone using a Keylogger or Sniffer, the password length doesn't matters at all, your password will get compromised no matter what. Yet, at a lot of places I read/hear that long passwords are more secure. How?

Can someone mention some other situations in which long password will not get compromised whereas smaller will?

share|improve this question
Makes a dictionary attack take longer. –  danielbeard Jul 5 '12 at 5:28
add comment

marked as duplicate by Rory Alsop Jul 5 '12 at 7:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

Short Answer

Long, complex passwords make you less susceptible to brute-force attacks. Each time you add either an additional character set (e.g. a-z, A-Z, 0-9, special symbols, etc.) or increase the character length of your password, you're exponentially increasing the total number of possibly correct passwords (i.e. the bits of entropy), and that means it will take longer for a brute force program to guess the right one.

Note that for this to work the password must be both long and complex. The password "123456789" is nine total characters, but will likely be guessed within the first dozen or so attempts.

share|improve this answer
Also, hackers usually skip symbols when brute-force cracking passwords, because it would take too long and few people use them, except maybe for the common !@. –  Matrix Jul 5 '12 at 6:17
add comment

If a database full of hashed passwords is compromised, the hashes for the shorter passwords are much more vulnerable to brute-force cracking. And if it's not salted, then anything up at about 14 characters is likely to be in a rainbow table and thus very vulnerable.

share|improve this answer
Exactly, the longer the password, the longer it takes to brute-force it because the number of hashes to generate increases with every letter. Dictionary attacks are different, if there is a 15 letter word in a dictionary, then using that word for a password is as secure as using "123456" (not secure at all). –  Matrix Jul 5 '12 at 6:13
Even if it's salted, modern GPU cracking can achieve almost 50 billion MD5 hashes per second using off-the-shelf hardware. For a 10 character random alphanumeric password, that's an average cracking time of 10 hours. For 11 characters, it's 15 days. The only solution is a slow, tweakable hash algorithm like bcrypt or PBKDF2. –  Polynomial Jul 5 '12 at 12:25
And for 16 characters, it's two and a half million years, using your own assumption of a times 36 increase in difficulty with an extra character. In practice, of course, that means it lasts until better hardware comes along, but well-chosen passwords of 16 characters or more are still effectively uncrackable. –  Mike Scott Jul 5 '12 at 13:00
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.