1

Safari on recent versions of Mac OSX can suggest passwords on signup forms. These passwords have the a similar form (the alphanumeric characters are separated by dashes: AbC-dEf-941-T3k) and they only contain 12 alphanumeric characters.

How safe are these passwords?

Improve this question
2
  • Is AbC-dEf-941-T3k the actual password recommended or just an example of the mask it uses?
    – Mr. E
    Commented Oct 17, 2016 at 19:07
  • it's the latter
    – gen
    Commented Oct 17, 2016 at 20:40

2 Answers 2

Reset to default
2

I believe that answering this question based on the mere complexity of the password generated may miss the mark. While it appears the passwords generated by Safari/OSX Keychain are quite complex and would be virtually impossible to crack with technology available today, this only helps in defeating brute force attacks.

Much more commonly, passwords are discovered through:

  • Malware/Keyloggers
    • This OSX keychain access should make it harder for malware and certainly keyloggers (since you're not typing anything) to obtain passwords.
  • Password re-use
    • Reuse of same password on multiple sites means taht if one site is compromised/experiences a breach, hackers will try this username/password combination on other sites.

So, that said, using unique passwords for each site and a password manager like Safari/Keychain increases your security significantly. This security enhancement goes far beyond the simple complexity of passwords, because by using a password manager you're engaging in a best practice that helps defeat numerous types of attacks to get your password.

Improve this answer
1
  • I think this answer would be greatly improved if you extended it with your comments on randomness from crovers' answer.
    – gen
    Commented Apr 3, 2020 at 7:57
1

Worst case scenario, assuming the attacker knows you are using this form, that is 62^12. Assuming they can try 100,000,000 passwords a second (which they almost certainly can't), it would still take them a million years.

So.. pretty good.

Improve this answer
8
  • 1
    Is this truly a "worst case scenario"? If the PRNG or random number generation process was flawed, these odds get a lot shorter.
    – Herringbone Cat
    Commented Oct 17, 2016 at 19:09
  • 1
    I suppose - that is worst case assuming that Apple is reasonably competent and uses the crypto random number generator they already have.
    – crovers
    Commented Oct 17, 2016 at 19:21
  • 1
    If they've got a database dump and the website is foolishly using MD5 hashing, they can potentially try more like a hundred billion per second than a hundred million, bringing the cracking time down to only a thousand years.
    – Mike Scott
    Commented Oct 17, 2016 at 19:25
  • @MikeScott All that being true, still WAY better than most user generated passwords.
    – crovers
    Commented Oct 17, 2016 at 19:30
  • @HerringboneCat randomness is precisely what I'm concerned about; crovers: I can derive 62^12 on my own, my question is not about that..
    – gen
    Commented Oct 17, 2016 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .