If a password repeats a sequence of characters, does it become easier to crack?

Question

I thought that if you repeated a sequence of characters in your password, the password would get easier to crack. I tried one of those websites which gives you an estimate of how much time it would take it to crack a password with a force brute attack (websites of dubious reliability, but anyway) and it doesnt seem to show any sign of weakness by repeating a sequence of 20 characters several times (the password gets increased by 30 orders of magnitude) Then my question is, if a password repeats a sequence of characters, does it become easier to crack?

Answer 1

Not exactly. More precisely:

• For any given human-generated password (based on a known word or character sequence), repeating character sequences from that base word to create a longer password makes that specific password just a tiny bit harder to crack than the underlying base word ...

• ... but the resulting longer password will be inherently weaker than other passwords of the same length that were created using a stronger length-extension method ...

• ... and it's hard for a password-strength meter to tell the difference.

To understand why, we need an understanding both of human password memorization strategies - and of the limitations of password strength meters.

A human password strategy like duplicating letters is a common way to meet password length requirements because the incremental cognitive burden for the user is low (only requiring the user to remember a little bit more information.) For example, if the minimum password length requirement was 12, then a password paaaaassword meets that requirement, with the user only having to remember two things:

1. My password starts with the word password as a base.
2. I then just repeat the a four more times.

Increasing password length with a "trick" only marginally improves attack resistance. While the raw Shannon entropy of the new password is higher, the effective entropy of the new password is only very slightly higher than the base word itself - because it's really only one more piece of additional information - which means that it can be easily used by attackers. Many password-lengthening strategies (adding digits, adding a couple of common special characters, doubling the word, etc.) are very well-known to password crackers. Most cracking software can try these strategies at very high speeds.

So strategies like adding repeating characters to a human-generated password are easy to implement in a password attack ... but they are much more difficult to implement in a password-strength meter.

This is why password-strength meters are notoriously inaccurate. A meter can use broad general measurements of strength (complexity, composition rules), and approximate some of the basic attacks (masks, simple wordlists, etc.) ... but it is impossible for a meter to mimic the millions of combinations of base words and human password-generation rules ... without starting to behave more and more like a password cracking engine. And such meters need to be much faster than that, in order to give real-time feedback to the user.

So the strategy of repeating characters only marginally increases the effective entropy, which will fall to high-speed attacks ... but the password-strength meter can't use the same attack strategies to tell the difference.

Answer 2

If you are talking a classic brute force attack then repeating a sequence will make no difference. Every character combination will be tried in turn so the length of the password is directly proportional to the length of time to crack.

A 10 character typical English password has about 70^10 possible combinations or 2.8 with 18 extra zeros

A dictionary attack might use 20,000 words, so repeating a word twice might gain you length, but it is still very susceptible to this attack.

Answer 3

I'm going to say yes, your passwords shouldn't have common patterns. I'll try to explain why but first allow me give some historical context.

Traditionally, a brute force attack is an attack which attempts to go through every possible combination until the correct one is found. This method is generally speaking obsolete today.

It was replaced with dictionary attacks, which take a wordlist and attempt to try each word in that list until the correct one is found. These words are usually common passwords and the name comes from the fact that it was originally just trying every word in the dictionary, as most passwords were single words.

Today, we have those same single word passwords, but most people add digits to the end, or attempt to complicate it in some way. Most attacks against passwords are still using the dictionary method, but a lot of them are now using rule lists too. These lists take each word from the wordlist, and then put it through a rule, where several variations of that same password are generated, usually adding numbers at the end and replacing specific characters with other ones which would be typical behavior someone who is attempting to strengthen their password may take.

So in short, yes. You are creating a pattern to your password. Some rules will include this exact type of behavior. Just try to make it as unpredictable as possible.