2

For better readability and easier entry of long passwords I thought it was a good idea to group these using a fixed separator like so:

f6hyF.75zaG.FhtYb.1a63h

Assuming this structure of the password is known to an attacker, are there any security implications, other than the effective length of the password only being 20 instead of 23, and the character space being reduced by 1 char (".")?

My main concern is that some encryption methods could allow the reconstruction of plaintext, given that some parts of the key are known.

Thanks for any comments on this!

Improve this question

2 Answers 2

Reset to default
5

If your password hashing function is any good, or even if it is bad but not hopelessly so, then adding the dots should not weaken the password. Password hashing functions, like other kinds of cryptographic hash functions, are supposed to be "all or nothing": either you have all the exact input, and then you hash to the output, or you learn nothing. The corresponding academic notion is that of a random oracle.

Of course, the extra dots do not increase the entropy of the password, while they may increase typing efforts. It is true that they increase readability, but whether it enhances or depreciates typability (mmh, that's not a word, apparently) depends on who is doing the typing.

Some poorly developed systems enforce arbitrary low limits to password length (e.g. they reject passwords longer than 10 characters) and the extra dots will make you hit that limit harder. Arguably, these systems are the problem, not the dots.

Improve this answer
5
  • If you are using, say OCLHashcat to bruteforce said passwords,surely knowing where the full stops are reduces the keyspace? You then only need to brute force the other chars. Yes, you will still need to compare the whole hash, but the overall total in the job will have dropped.
    – user53693
    Apr 22, 2015 at 13:11
  • @Ian I think the point is that if you know where the dots are then adding dots to "aAksjJAskdf78A27" to make it "aAks.jJAs.kdf7.8A27" does not make it easier or harder to crack - there's 16 characters to bruteforce either way.
    – Mike Ounsworth
    Apr 22, 2015 at 13:18
  • Yeh sure, bruteforcing a 24 char password (depending on the algo used) could be a serious undertaking. However, adding known characters to known positions in a password reduces the total number of passwords needed to try substantially. At least is how I read it.
    – user53693
    Apr 22, 2015 at 13:24
  • 1
    @Ian the question is about adding three dots to a 20-character password, not replacing three characters in a 23-char password with dots. We assume the attacker knows all about the extra dots; he still has 20 non-dot characters to guess. The underlying question is whether these known dots induce extra structural weakness due to some postulated weird interaction with the hash function computation; that, is, weakness beyond the fact that the attacker knows 3 of the 23 password characters, and has "only" 20 more to guess.
    – Tom Leek
    Apr 22, 2015 at 14:19
  • Yes, I see now, re the replacing/adding thing. I didn't appreciate what OP was asking. As you were :)
    – user53693
    Apr 22, 2015 at 14:23
0

I actually recommend such a thing when there is a long password to be typed a rare amount of time by non technical users (best example being setting up a Wifi access for instance).

Personally I use the dash '-' character separator instead, and this makes the password to look just as a serial number a user would have to type to register a software (like "aPr8-eerT-6F4g-9dgV"). So it seems like something familiar to the user, it is easier to type and check, and as secure against someone knowing the structure (and even more against someone who doesn't).

Better usability, equal if not better security, so why not taking advantage of this technique :) ?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .