I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't see how this isn't basically a brute force problem. In which case an random sentence of at least 24 characters should be impossible to crack, no?
Yes, it is a bad idea. The number of books in the world is quite finite, and efficient password cracking software can make billions of guesses per second against an offline password hash. It is not at all difficult to try every single possible combination of phrases in every single digitized book in the world.
The length of the sentence itself doesn't matter either. This is because an attacker will be taking entire sentences and phrases at once and hashing them. They will not try to brute force it from scratch.
The reason this could be considered bad is that the search space is smaller
- Sentences have a structure they must adhere to - making rule based brute force simple
- Popularity of books make creating a word list easy. Top 100 books of all time, the bible
- Books are personal - so any information about yourself can help reduce the books to look at
- There is roughly 12500 sentences per book - sentences are not going to be unique per book
That said this only really matters if an attacker knows you use a book otherwise your password will be treated like every other one.