Known password length, brute force character in place?

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and saves us huge amounts of time. Still this change is insignificant for very long passwords. So I was wondering if we can brute force every character in place. It would be like cracking a combination for a mechanical lock. We try every character in place until it "clicks" into place, then we move on to the next character, and so on.

• Not for properly digested passwords. Oct 11, 2012 at 23:56
• Have you ever seen a login screen that said "you only got one letter wrong, keep trying!"? Oct 12, 2012 at 0:23
• JtR factors in trigraph frequencies when brute-forcing, i.e. it would try "bac" before "abc", since the first is a more common combination in English. That's not so dumb, but it's still brute force. Oct 12, 2012 at 0:27

If you have a password verification mechanism which lets you know, in any way, whether a given letter is correct or not, independently of the others, then you have an awfully weak, stupidly designed password verification mechanism. That's what happens when you let Hollywood scenarists deal with reality.

This board game is an illustration of how bad it is: if a letter "clicks into place", as you put it, then your password can be beaten by an 8 years old kid from the early 70s (and without any computer at all). I strongly hope that login screen security has increased a bit beyond the Disco kid security level.

• +1 for the board game :-). It's interesting to note that some padding oracle attacks retrieve the plaintext message one byte at a time. Tom Ptacek calls this "Hollywood style" cracking. Oct 12, 2012 at 3:31

You could if the password verification is done very badly. Namely if the password verifier does all of the following:

1. The password verifier stores the passwords in the clear (and not hashed as they should be)
2. The password verifier compares the guess and the password directly (and not a hash of the guess and the password)
3. The password verifier behaves differently depending on which character the password check fails on