-13

It is 20 characters long, mixes alphanumeric and special symbols. It is one among ** 20.

closed as off-topic by Ohnana, Iszi, Adi, Steffen Ullrich, LvB Mar 22 '16 at 9:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Ohnana, Adi, Steffen Ullrich, LvB
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 50
    @PierreB not anymore – WorseDoughnut Mar 21 '16 at 20:46
  • 2
    That depends on what set of rules your attacker is using to generate guesses. if "repeated charecters" is high on the list, then NO. – Mike Ounsworth Mar 21 '16 at 20:46
  • 3
    By your logic, "aaaaaaaaaaaaaaaaaaaa" is a secure password as it is one of **20 (I assume you mean 64 to the power of 20) passwords. Basing password strength just on length is clearly wrong. – Neil Smithline Mar 22 '16 at 1:56
  • 1
    Regular, repeated patterns are always a bad idea. It's what got Enigma cracked. – Fiasco Labs Mar 22 '16 at 4:36
  • 2
    @PierreB if this question is about thinking how to create safe passwords, there are numerous detailed questions and answers on this site to explain how to do that. Your question is constrained to analyzing a single password. – schroeder Mar 22 '16 at 5:17
20

Well I guess now that you stuck it on here, someone will probably add it to a dictionary list, so that specific one probably isn't anymore.

  • 6
    This is not even an attempt at answering the question. It is just a comment and a non-constructive one. – techraf Mar 22 '16 at 4:11
  • 20
    I think this does actually answer the question quite well. It is a terrible question. – Rory Alsop Mar 22 '16 at 8:51
  • 1
    Furthermore, it states that "any password that is shared is by definition insecure", which is very relevant. – Justin Time Nov 13 '18 at 19:30
11

The problem with this password is that it is based on a pattern. As long as your pattern remains a secret, then it has some value. But, as soon as your pattern becomes known, then it is only as good as a 4 character password.

The best case is to have a password that is still strong, even if the world knows how you generated it.

6

There are lots of hackers out there trying to crack passwords. At least one of them is bound to have rules for Repeated Characters high up in their guessing order.

6

The security of a password depends roughly on its entropy, which itself is a metric of how much information it contains. The password "AAAAA" has terrible entropy, since it's the same character repeated five times. On the other hand, "e^#Yc" is, whilst still way too short, much better. It can't be described as easily.

Relying entirely on repeated characters is bad because there just aren't that many ways to do so. You only have four unique characters in the password. If I tried every way to combine four alphanumeric/symbol characters, I'd get 72^4=26873856 combinations. If I were to use up to five copies of each symbol, then there would be 72^4 * 5^4 combinations (since I can use 1, 2, 3, 4, or 5 of each character, which is only 5 choices). This gives 16796160000 combinations. Whilst better, it's still not that good. Using ten random alphanumeric/symbol characters would give 3743906242624487424 combinations, for example.

I think your problem is a misunderstanding of password strength. Mixing letters and symbols, using capital letters, and so forth are ways to increase the search space of a password. The larger the search space, the harder it is to break a password, since the number of possible passwords is (search space)^(length).

However, if your password is either very short or effectively very short (repeated characters are an example of this), then it's still weak!

  • This is misleading: "The password "AAAAA" has terrible entropy (...) "e^#Yc" is, whilst still way too short, much better." Entropy does not qualify password. If a validating system would allow the second pattern, the entropy does not change just because you set "AAAAA" as a password. – techraf Mar 22 '16 at 3:35
  • I'm sorry? I don't understand what you're saying here. The entropy of a piece of data describes how much it is like random noise; information that is "consistent" has less entropy than data that is not. – etherealflux Apr 4 '16 at 2:57
  • There are different definitions of entropy. I think when talking about brute-forcing a password this one applies: Entropy as a measure of password strength. It does not qualify a password, but a system and for the two sequences-of-bits from this answer the entropy is the same, regardless of one sequence having a more appealing literal representation to human. Please correct me if I am wrong. – techraf Apr 4 '16 at 3:47
  • Think of it this way: a very regular 111100001111000011110000 might be represented by 5 different characters 11110 00011 11000 01111 0000x. Unless you considered how a given system renders AAAAA or e^#Yc you can't say anything about their entropy in a data randomness-sense. – techraf Apr 4 '16 at 4:09
  • Ah, yeah, that's not quite right. Password entropy is a bit hard to visualize, but it does depend on the apparent randomness of the data (and not just the length). Given a the alphanumeric+symbol character space, you can compute the entropy of different strings; AAAAA should come out less than e&#Yc (but I haven't done that math in a while!) As for how the symbols are represented, that depends on what's considered to be a valid symbol. The search space does rise if you add more representations of "A", but a string of a bunch of A's is still really low in entropy. – etherealflux Apr 4 '16 at 5:32
1

It would depend on how the hypothetical attacker approaches guessing the password.

Against a simple brute-force attack (i.e. trying every possible combination in the available key space) this password would most likely hold up very well indeed, because it's very long. Unfortunately, most attackers won't be using pure brute-force attacks.

It could also be expected to do well against a pure dictionary attack, for obvious reasons.

However, a clever attacker might be reasonably expected to account for patterns like repeated or sequential characters in their attack. Since this password's structure is very regular (5 repetitions each of just 4 characters) it would fall much more quickly to an attack that's looking for patterns.

Suppose an attacker were to gain access to a password database containing a hashed version of this password (as happens all the time.) Let's say the attacker has already exhausted their dictionary attacks and is turning to pattern-based attacks. Such an attack could be expected to take into account logical sequences (e.g. 12345,) spatial sequences (e.g qwertyuiop,) repetitions, etc. and various combinations of them. I don't know if I could reliably estimate the size of such a key space, but it would certainly be significantly smaller than if the key were truly random. This question has some discussion about the principles behind pattern-based password cracking.

-4

Try this service: https://howsecureismypassword.net/

According to this service, cracking your password would take 43 quintillion years with a regular computer.

  • 2
    That does not take into account dictionary and rule list attacks, amongst others – techydesigner Dec 8 '16 at 9:34
  • @techydesigner Yes, as it is not supposed to be. You can't really take dictionaries into account. There may be a very complex password, yet it can be in a dictionary. Which happened to me recently. (Using same password in 2 systems, one of them was smth i really didn't care at all. Result: one of them compromised, password gathered and put in dictionary, and the other safe system cracked easily) – ferit Dec 9 '16 at 10:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.