3

So let's start of example. I live in England, and have a Polish keyboard. I can use Polish specific letters like ąćęłńóśżź, one could also use German ßäë etc.

Would using those letters make password stronger?

I think that definitely it would decrease chance of random person guessing my password, as they may not be able to input required character.

I also think that this would make password stronger as usually even if database is stolen brute force programs usually goes through standard a-z, 0-9 and special characters like !@#$%^&*()_+=- etc. But it seems that those language specific letters are not used to find password.

2 Answers 2

5

Using characters specific to language does make password stronger, but not exactly for the reason you stated. If you count on the attacker not including your language specific characters into their dictionary, then your password will only be safe until they know that you are using a non English alphabet. And according to Kerckhoffs's principle , you should presume that they already know this.

However, if you use your specific characters along with character in English alphabet, your password will become stronger simple because each character in your password will have more entropy. Let's say we are using a randomly generated, lower case only password (in practice you should mix both lower case, upper case and special character, but the basic is still the same). Take your Polish alphabet for example, if you combine Polish and English alphabet, you will have 35 distinct characters, while the English alphabet only has 26. That means each character in our Polish+English password will have roughly 5.13 (log2(35)) bit of entropy, while a character in the English password will only have around 4.7 (log2(26)) bit of entropy.

Now let's say our password is 15 characters long, in the first case we have 15 x 5.13 = 76.95 bit of entropy, while in the second case we only have 15*4.7 = 70.5 bit of entropy. If you keep mixing more and more different alphabets, then each character in you password will have more and more entropy, and your password will become stronger given the same length. However you run the risk of not being able to login from other devices because they don't have your language keyboard installed, that's something you should keep in mind.

4
  • While implied, but not evident from your math example; simply using a longer password with less complexity will beat a shorter one with more complexity.
    – wireghoul
    Aug 13, 2016 at 13:36
  • 1
    Yes that's right, when it comes to password, size matters.
    – duongntbk
    Aug 13, 2016 at 13:54
  • The idea that "a longer password with less complexity will beat a shorter one with more complexity" is not even wrong. Just one counterexample: a 12 character random ASCII password has about 79 bits of entropy, which handily beats the 44 bits of a much longer, XKCD-style "correct horse battery staple" passphrase. You could just as easily construct an example that goes the other way around—again, the claim is not even wrong. Aug 13, 2016 at 22:17
  • 1
    I think, what he meant by "less complexity" was "smaller character set", with all other parts of the password generation being equal. E.g. 16 random lowercase English characters beats 8 mixed-case with symbols and international alphabets.
    – Ben
    Aug 14, 2016 at 4:01
3

Not in any reliable way. In theory a larger character set increases the search space for the attacker, but that only reliably helps you if you pick passwords at random (literally at random, for example by throwing dice), which I suspect is not what you have in mind.

But in practice, there's several problems. First of all, there's too many programmers out there who are incompetent and disdainful when it comes to character encodings, and routinely write software that doesn't handle them consistently. So you risk all sorts of issues:

  1. A website may do something funny to your passwords' diacritic-carrying characters—like replacing them with ? or just deleting them. This is terrible, because your password in that case doesn't have the strength that you expected and you wouldn't even be able to tell.
  2. Suppose then that such a website updates their software to fix the bug. Ooops, now it doesn't recognize your password anymore!
  3. Or the developers, without giving much thought to it, might decide to implement a front-end "permissible password" check that forbids non-ASCII characters.

Second, the way you're approaching the question can be boiled down to this:

  • "Can I outsmart the password crackers if I use this clever trick?"

They're going to spend a lot more time studying how to outsmart users than you're going to spend studying how to outsmart them. They'll just read all they can find in the Internet about how people pick their passwords (including this question!) and learn from it to improve their password attacks. Remember, they don't just try to crack your password by guessing it individually—they program really powerful computers to test millions of passwords per second, and use them to guess thousands of users' passwords at a time.

So I don't know, but I sure wouldn't bet on you.

The only reliable way to defeat password crackers is to pick passwords at random from a very large set. The Electronic Frontier Foundation's page on creating strong passwords has good advice. The most important is to use a password manager program to generate and store a unique, random password for each site. That's it.

1
  • This is a great answer. You're #1 point about behind-the-scenes char substitution happening outside of one's knowledge is definitely worth contemplating. However I wonder about the statement 'They're going to spend a lot more time studying how to outsmart users than you're going to spend studying how to outsmart them. ..So I don't know, but I sure wouldn't bet on you.' For the most part, doesn't one mostly just need to avoid being the low-hanging fruit? Both as a user with poor attention to password strength, and/or as a developer, with unsophisticated design that might allow injection, etc?
    – elrobis
    Oct 14, 2021 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .