5

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could only remember 8 letters in a random string. Let's say the particular random string they chose here is atwer1414.

What is a more secure password: atwer1414, or atwer1414peter123? I would assume the longer one is more secure, but I don't know enough about hashing to know if the known/guessable peter123 being in there would give away any information about atwer1414.

  • 1
    In most cases a longer password will be more secure but in very specific maybe weird scenarios it could depend on the hash algorithm or encryption algorithm. For example, depending on the scenario knowing a part of the encrypted message may disclose part of the key. – Eloy Roldán Paredes Dec 28 '15 at 9:23
  • @EloyRoldánParedes Interesting, thanks. Do you know any examples of hash algorithms that would have problems like that? – Loktopus Dec 28 '15 at 12:39
  • I don't know about hash algorithms but you can see information in crypto stackexchange site if you search "known plaintext attack" crypto.stackexchange.com/search?q=known+plaintext+attack. The XOR cipher may be an example: en.wikipedia.org/wiki/XOR_cipher – Eloy Roldán Paredes Dec 28 '15 at 17:06
7

Certainly a longer password with comparable or higher complexity, like your example, results in a safer password.

Though we have to say what "safe" means in this context. An attacker should not be able to brute-force the login. A long and complex password also adds to the security if an attacker would ever get their hands on the password database (if they don't store them as plain-text).

There are actually two scenarios regarding password security which are affected by the complexity and length of your password. The first one is an attacker who is only able to test against a black box, e.g. the login of a website. If your password would be too trivial like "password" then an attacker can gain easy access, even with a lot of security mechanisms in place (excluding two-factor authentication). This becomes much harder for an attacker the longer the password gets, especially since most websites limit login attempts.

The second scenario is a database breach where the attack has access to the password database. The security of your password, meaning "Is the attacker able to figure out my password?", does not only depend on you, but how the website handled all passwords. If the store them in plain-text you loose, no matter how complex they are. What is insecure, but often occurs, is simple hashing with no salt or a global salt for all accounts. In this case it helps having a complex and long password, because what the attacker does, is checking the hashes from the database against pre-computed lists of common passwords or even entire dictionaries of combinations. A long and complex password means more attempts are necessary for the attack. A properly secured website should use a per user salt (and perhaps pepper), making rainbow-tables and dictionaries pretty much useless. This would even protect fairly simple passwords, but still the longer the better (or safer).

So the reason why you should use long and complex password is the first scenario and the second scenario in case of improper security. You can see as well, that the actual security also depends on the web-developers not just on your password.

  • Thanks. I knew most of that going in, and was asking about an attacker trying to figure out what your password was from a dumped password database full of properly salted passwords. I'm guessing even if it's possible to gain some information from a known phrase in a hashed password, it probably wouldn't help you that much, and that the longer password will still be better. I just wanted to see if anyone knew enough about hashing algorithms to tell me if having a known phrase in a password could somehow help you deconstruct the full password from the hash. – Loktopus Dec 27 '15 at 20:42
  • @Didericis If the attacker knows part of the password he has an advantage. This does not give him an easy shortcut, there is no similarity or pattern between the hash of "atwer1414" and "atwer1414peter123" (assuming a reasonably secure hash function). Though if he has the database dump and wants to target your password specifically for some reason, he does no longer need to try 17 characters, only 8. With a good custom dictionary this should be possible. – John Dec 27 '15 at 22:09
  • Ok, thanks. So they'd still have to bruteforce those first 8 characters? I thought there might be some magical math that would reduce the amount of bruteforcing you'd need to do. ie, if you know that peter123 is in afterw1414peter123 and aaaaaaaapeter123, and know the hash of aaaaaaaapeter123 and a couple other combinations, is it any easier to figure out afterw1414peter123 than it would be to figure out afterw1414? – Loktopus Dec 27 '15 at 22:23
  • 1
    No that would not make a difference as the number of unknown digits remains the same. As I said before you would not find a pattern between the hashes even with partly same input. This of course assumes we are talking about a hash function like SHA-256 with so called avalanche behavior. Changing one digit in the input causes greatly different output. – John Dec 27 '15 at 22:37
  • 1
    @Didericis An attacker would not need to brute force. There even is a possible advantage in case he knows part of the password like in this case. It has a distinct pattern with a word followed by numbers. He could create a custom dictionary and could need less attempts. What I have assumed in my previous answer is, that he knows how long the original password was, if he doesn't things get even more complicated. – John Dec 27 '15 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.