According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
3 Answers
I would have to disagree that his claim of three 'three-letter' word is secure. In his article he says:
So - 500 x 500 x 500 = 125,000,000 (one hundred and twenty five million) possibilities.
Maybe that doesn’t sound like a lot - but if you could check 20 of them every second, 24 hours a day, you would need roughly 60 days to get through them all!
First of all, password cracking tools and combination of hardware can crack way more than 20 per second especially if the list of combinations is pre generated. On top of that, if a hash of these passwords are retrieved then an offline cracking attack can be performed which means the attacker has all the time in the world to try to crack them and if it actually did take 60 days, to a motivated criminal that is nothing.
The simple fact is that 9 alphabetical characters is just too short in the present day.
12 characters expotientally makes it more difficult but using only alphabetical isn't the best.
End of the day, I like to use a password manager and generate unique 20+ character password with alphanumeric, special characters and mixed case.
-
Also have a look at youtube.com/watch?v=7U-RbOKanYs If you have access to the hash you can try billions of combinations per second with commodity hardware.– PeterCommented Oct 22, 2017 at 17:53
-
-
2"way more than 20 per second"...give him a break, he's only off by 9 orders of magnitude or so.– BenCommented Oct 23, 2017 at 4:28
-
It's not the difference between 9 and 12 alphabetic characters that matters, it's the difference between 3 and 4 words from a 500 word dictionary, which is about 27 bits and 36 bits respectively. 9 random characters would be about 42 bits, and 12 would be about 56 bits. Commented Oct 23, 2017 at 15:59
I concur with everything @nd510 said in his answer - 9 alphabetical characters is not enough entropy to be secure, and I also use a password manager to create unique passwords with a mix of cases, numbers, and symbols.
I want to add, however, that passwords like dinwryran may be resilient to brute force attacks in the specific situation where the attacker does not know your method of generating passwords. This is security through obfuscation, and is not wise. I'll explain.
If the attacker doesn't know that you're using 9 alphabetical characters for your passwords, then their brute-force method would not generate only 9 alphabetical characters, but would include all alphanumerical and special characters of any length. Because dinwryran is not in common password dictionaries, a normal dictionary or rainbow attack would not work on it, and therefore the attacker would be forced to brute-force. If the attacker does not know that your password is 9 alphabetical characters, then it's unlikely for the attack to be successful.
That said, security through obfuscation is not security at all; using passwords like dinwryran is only safe when (a) the attacker does not know your method of creating passwords, and (b) the system accepts passwords that are much longer and contain any characters. dinwryran is only safe because of attacker ignorance, not computational complexity.
On the other hand, my and nd510's method of generating passwords is no less secure by the attacker knowing how the passwords were generated, and is computationally secure.
No dinwryran is not secure. You can test using any of the modern strength meter, such as zxcvbn or the one built using Neural network.
Bottomline is passwords below 10 characters are rarely safe to use. As @nd510 suggested: use password manager and generate random alphaneumeric strings. You test the difference in the website link that I gave above.
dinwryranlasts about a half-hour