Since they won't brute force a 19-char password, I was wondering if the attacker's dictionary is simply sorted by frequency? could these passwords have roughly the same strength?
carp ably feud whir mailless larksome blameful girasols
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
No. If you're using multi-word (diceware-style) passphrases composed of actual words, the length of each word doesn't matter.
If you assume the attacker is aware of the method you used for generating your passwords (which you should, per Kerckhoffs's principle), then you can expect that the attacker will attempt to crack your passphrase with a dictionary attack and therefore the word length is irrelevant; only the number of words and the size of the dictionary you randomly selected them from matters.
If you assume the attacker isn't aware of your scheme and is just using brute force, then you can expect the attacker will take many orders of magnitude longer than they otherwise would using a dictionary attack, therefore since your password is designed to stand up to a dictionary attack it is also safe against brute force.
To make that more concrete, assuming you chose "carp ably feud whir" randomly from a 7776-word diceware dictionary, the attacker must try an average of 77764/2 ~= 1.83 quadrillion passwords before cracking it. If instead the attacker used a brute force of lower-case letters and spaces, you'd instead expect this same attack to take (26+1)19/2 ~= 786 billion quadrillion tries on average. Since 786 billion quadrillion is greater than 1.83 quadrillion, you can safely conclude that the brute force attack isn't worth worrying about, as the dictionary attack is a much more significant threat, and therefore the length of each word doesn't matter.