According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
I would have to disagree that his claim of three 'three-letter' word is secure. In his article he says:
So - 500 x 500 x 500 = 125,000,000 (one hundred and twenty five million) possibilities.
Maybe that doesn’t sound like a lot - but if you could check 20 of them every second, 24 hours a day, you would need roughly 60 days to get through them all!
First of all, password cracking tools and combination of hardware can crack way more than 20 per second especially if the list of combinations is pre generated. On top of that, if a hash of these passwords are retrieved then an offline cracking attack can be performed which means the attacker has all the time in the world to try to crack them and if it actually did take 60 days, to a motivated criminal that is nothing.
The simple fact is that 9 alphabetical characters is just too short in the present day.
12 characters expotientally makes it more difficult but using only alphabetical isn't the best.
End of the day, I like to use a password manager and generate unique 20+ character password with alphanumeric, special characters and mixed case.
I concur with everything @nd510 said in his answer - 9 alphabetical characters is not enough entropy to be secure, and I also use a password manager to create unique passwords with a mix of cases, numbers, and symbols.
I want to add, however, that passwords like
dinwryran may be resilient to brute force attacks in the specific situation where the attacker does not know your method of generating passwords. This is security through obfuscation, and is not wise. I'll explain.
If the attacker doesn't know that you're using 9 alphabetical characters for your passwords, then their brute-force method would not generate only 9 alphabetical characters, but would include all alphanumerical and special characters of any length. Because
dinwryran is not in common password dictionaries, a normal dictionary or rainbow attack would not work on it, and therefore the attacker would be forced to brute-force. If the attacker does not know that your password is 9 alphabetical characters, then it's unlikely for the attack to be successful.
That said, security through obfuscation is not security at all; using passwords like
dinwryran is only safe when (a) the attacker does not know your method of creating passwords, and (b) the system accepts passwords that are much longer and contain any characters.
dinwryran is only safe because of attacker ignorance, not computational complexity.
On the other hand, my and nd510's method of generating passwords is no less secure by the attacker knowing how the passwords were generated, and is computationally secure.
Bottomline is passwords below 10 characters are rarely safe to use. As @nd510 suggested: use password manager and generate random alphaneumeric strings. You test the difference in the website link that I gave above.