Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
Google Account: implications of using application-specific passwords

In 2-step verification of google accounts, we need to use the Application-specific passwords generated by Google for use of applications.
Even though it is generated by Google it is composed of only small case characters like
"bmkf wjug rtul opef"

How much safe if this password against known attacks?

share|improve this question
add comment

marked as duplicate by Jeff Ferland Aug 30 '12 at 4:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

I don't know the exacts on how these passwords are generated. But I'll make some assumptions.

Assumption The passwords are always 4 lower case letters followed by a space, and then repeated 3 more times.

Brute forcing That means there is 26^16 possible password. This is 43608742899428874059776 possible passwords which can be represented in 76 bits. Can this be done? I say yes, quite easily.

Problems Google has other mechanisms to stop you from guessing 43608742899428874059776 times. After you try 3....you will probably get locked out or require a recaptcha. This will slow you down enough to make brute forcing that password unfeasible.

Google does good....this time.

share|improve this answer
    
And, more importantly, if you guess one application password, you're still SOL for all other application passwords and have to guess each manually; that's a big part of the point –  Ben Brocka Aug 23 '12 at 16:30
    
Exactly .. the passwords look a little weak at first but Google will CATPCHA you if you hit 3 failed logins so it's actually a lot safer. One would hope that they have systems in place to detect if someone has broken their captchas but I suppose that won't be documented. –  Andy Smith Aug 23 '12 at 16:31
2  
Also i Doubt Google displays a capcha after 3 tries in an "application" like a mobile Gmail java application. no? –  vivek_jonam Aug 23 '12 at 16:33
1  
The passwords don't actually contain spaces. Google performs a method often called pretty print which basically makes what normally would be ugly into something that less well ugly. It was used to make your Calculus equations on your TI-89's look pretty. –  Ramhound Aug 23 '12 at 16:54
2  
@curiousguy - I know. 4x10^22 is a huge number and infeasible for online attacks. If google lets you try indefinitely and somehow you went through a billion tries per second, it would still take a about a million years before you are likely to get it. Google would like blacklist your IPs after a couple thousand bad attempts (thinking you attempting to DoS them). Even for offline hashing at a rate of billions passwords tried per second; the electricity costs alone would be prohibitively expensive to crack it (see last line in table). –  dr jimbob Aug 30 '12 at 5:28
show 7 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.