Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm only taking about security against bruteforce attacks.

I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the programming), as randomly guessing, storing the list of guesses, generating a new random guess, checking it against the list of old guesses and trying if it hasn't been guessed would be inefficient. Also, ZZZZZZZZZZ is very unlikely to be in a dictionary attack.

Using that logic, wouldn't ZZZZZZZZZZ be the most secure password out of all passwords that are 10 or less characters?

share|improve this question
    
That's one way of doing it, you also attach a weight to each password, so that "password" is first, maybe throw in some randomization into which one is next –  TruthOf42 Apr 14 at 19:01
    
But ZZZZZZZZZZ wouldn't be in a word-list for a dictionary attack. –  Chipperyman Apr 14 at 19:02
2  
That assumes that the attacker behaves like you proposed. What if they start with a random password, run until ZZZ jump to aaa until they're at the start? –  CodesInChaos Apr 14 at 19:04
    
@chipperyman573: I just checked in my big list of previously leaked passwords that I would use in a penetration test as a word-list against hashed passwords. "ZZZZZZZZZZ" is in there, so if you chose that and I had your password hash, I'd break it in considerably less than a second in the pre-cracked passwords run. –  Matt Apr 15 at 1:58
    
Possible extension of the question: does it make sense for a random password to have a non-random first character (since 0, 1, a, A, z, Z would probably be brute forced early, hence reducing the time it takes for a strong password)? –  domen Apr 15 at 8:44

2 Answers 2

up vote 6 down vote accepted

The attacker is in your head. By this I mean that the attacker knows you and knows your password generation strategies. If you systematically use passwords beginning with a 'Z', then he will start his search with such passwords. (Especially since you have described this very method on a publicly readable Web site.)

You might have an edge if you choose your passwords differently from everybody else; but attackers adapt, and adapt fast. Choosing 'ZZZZZZZZZZ' as password is strong only as long as attackers try potential passwords in alphabetical order; and attackers have already stopped doing that. They first try passwords with "structure", such as ten repetitions of the same letter, because that's a kind of passwords that human users choose (then they continue with derivations from common words and names).

It is hard to outsmart attackers; it is especially hard to know how much you outsmarted attackers, because smartness is not something that is readily quantified and measured. The normal stance is to assume that the attackers knows everything about your password generation process, save the random choices within that process; this is the only way you can reliably estimate the strength of your password.

Regardless of how you choose your password, an attacker who is intent on trying all possible letter combinations can always generate these combinations in a random order, which guarantees him the theoretical average success rate of N/2 (if there are N possible passwords, he will try on average half of them before hitting the right one). There is no password generation method which can be used to prevent that.

share|improve this answer

The assumption that password crackers go from a to ZZZZZZZZZZ is probably incorrect. Password crackers have evolved to use much more complex techniques that extend to using markov chains etc. To get a better idea of what professionals do when attemting to crack a password read this great article:

Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”

Even in the case where they did enumerate from a to ZZZZZZZZ it should not take a pro long to get to ZZZZZZZZZZ given the processing power they have at their disposal and the limited length and key space of the example you provided.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.