3

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,000,000 passcodes to try if they were to brute force. The phone locks for 5 minutes every time the passcode is entered wrong, too.

However, if I am expected to never use any sequential or repeating numbers, surely this reduces the space of possible codes by a huge amount? Thus making the phone easier to break into. Why would this policy be used?

|improve this question
8

Assuming the policy on sequential numbers is very defensive and concerns the following digit, and assuming that 9 is followed by 0, this reduce the number of available passcodes to 10*8^5=327.680

Which reduce the possibility to a subset containing 32.76% of the original possibilities, which is not that much different on a scale.

However, such a rule prevent the user from setting trivial passcodes such as 000000 or 123456 which are incredibly dangerous to set on a corporate phone as these are very common passwords that a potential malware will try to input.

In conclusion, the risk of reducing the number of available passcodes to chose from is small compared to the impact of letting the user set a trivial password.

|improve this answer
  • 2
    The key component here, is that an attacker would not start with a brute force attack. A dictionary attack (I.E. Trying very common patterns first) would immediately discover the common passcodes. – Chris Murray Oct 7 '19 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.