Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which would be harder to crack: a password comprising of n characters randomly selected or a password comprising of x randomly selected characters repeated m times so that m*x=n.

For example:

9*jtRf_ki&^tN4%^E3d^75HG

As oppose to:

u7I*u7I*u7I*u7I*u7I*u7I*

or:

kL:@90kL:@90kL:@90kL:@90

As far as I can tell none of the above contain dictionary words and they all contain a good mix of keyboard characters, i.e the attacker would to try capitals, numbers, special chars etc. so they should be hard to crack.

Why might the former example be harder to crack than either of the latter two?

The intention is be able to provide password advice that renders brute forcing attacking really difficult but gives a human easy visual / muscle memory.

For the purpose of the question assume the attacker is coming in blind, they have no knowledge of the pattern or whether or not a pattern would be used and there is no requirement that a password be a repeating pattern, it could be anything, though they do know that any character and any length is allowed for the password.

share|improve this question
    
Your last sentence is not complete… What should be noted? –  Qeole Jun 14 at 12:16
    
my apologies, i was going to write something that was essentially irrelevant about how brute force isn't the only way of getting into an account, but I decided against it, I must have fat-fingered the keyboard and accidentally posted it –  Toni Leigh Jun 14 at 12:20

2 Answers 2

Here is line #950 of file /etc/john/john.conf, which contains rules for creating passwords to test:

# Try strings of repeated characters.

So I would say that, yes, there is an increased risk at choosing repeated patterns for a password, as some cracking tools do take this possibility into account.

Regardless of that, I would not advice people to do so anyway; if an external attacker may not know that password are made of repeated patterns, an internal person of my organization could be tempted to get unauthorized access to another account. Or information could leak anyway, and an external attacker could know about it. Your first example u7I*u7I*u7I*u7I*u7I*u7I* has only four bytes of entropy, it's very low.

Still, if you had to choose between u7I*u7I*u7I*u7I*u7I*u7I* and u7I*, I guess first solution would still be better, but that's far from ideal.

What about suggesting to users to use a password managing tool instead?

share|improve this answer

My short answer is yes, repeating characters are far easier to crack than totally random characters. A password attack tool can try repeating characters far faster than it can cycle through all possibilities of non-repeating characters. For example, if an 8 character password consists of a pattern of 4 lower case letters that repeats twice, there would be: 26^4 possibilities vs. 26^8. If the attacker is looking specifically for that pattern, it would be 26^4 times easier to crack the repeating password than a random password. The other posted answer indicates that password attack tools are already configured to look for this type of pattern, so yes, repeating patterns can greatly weaken a password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.