1

For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks.

A novel password scheme is suggested, where it requires long passwords (10-12 symbols) that include at least one non-alphabetic symbol found on a standard computer keyboard. When the user enters their password, the system will accept or reject passwords one character at a time. It is claimed that this would make it easier for users to remember very complex passwords, while maintaining the security of the authentication mechanism.

Explain why this approach is not a good idea.

Can anyone provide their input?

3
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented Mar 20, 2023 at 23:23
  • it implies the password must be stored as plain text, which is well-covered in other onswers.
    – dandavis
    Commented Mar 21, 2023 at 18:11
  • Is this a homework problem?
    – Adam Katz
    Commented Mar 24, 2023 at 15:36

1 Answer 1

1

Let's say each character in the password could be any one of 90 symbols [a-z, A-Z, 0-9, !,@,#,$, etc).

An attacker wants to brute-force the password. The attacker starts by entering 'a', for the first character of the password, the system rejects it. Then, he tries 'b', the system rejects it. He keeps trying characters sequentially, until finally the system accepts the character that he enters as the first character of the password. This is guaranteed to happen in 90 tries or less, because the first character must be in the set of 90 characters above.

Then, the attacker moves to the next character. After <=90 tries, he is guaranteed to find the correct second character.

Do you see a pattern here? If the password is 10 characters, he is guaranteed to find it in only 900 tries or less.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .