16

When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password?

There are 26 lowercase alphabet characters. Lets assume that there are 100 characters in the entire group of capitalized alphabet characters, symbols, and numbers. Now let's look at any password of length 6. There are (26 + 100) ^ 6 possible passwords of length 6. A hacker would have a [1 / (26 + 100)] ^ 6 chance of guessing such a password. The hacker has no way to tell if you used only lowercase alphabet characters or you mixed lowercase alphabet characters with special characters, so he must guess with the entire sample space on each character. If, however, he knew you were only using lowercase alphabet, then, yes, the probablity of guessing your password would increase to (1 / 26) ^ 6. But in the real world, a hacker wouldn't be able to figure which set of characters you used.

Improve this question
1

2 Answers 2

Reset to default
15

Your assumption is that attacker password guesses are uniformly distributed among the domain of potential passwords. This assumption is incorrect: guesses are skewed toward more likely passwords, which are lower-case dictionary words as those are easiest for users to type and to remember.

The benefit of using a complex password then is that it will probably take a longer time for the attacker to try your password as a guess. Incidentally, when considering a large multi-user system, the "no need to outrun the lion" rules apply and in many cases a good password is one that's more complex than another user's. That is not always true if an attacker is specifically targeting you rather than the system.

Improve this answer
4
  • Is a non-dictionary all lowercase password just as safe as a recommended password? For example, is "jbezlqw" as safe as "JbE$1qW"?
    – JoJo
    Jun 13, 2011 at 15:25
  • 1
    Who's doing the attacking? That's the point, it depends on what the attacker tries.
    – user185
    Jun 13, 2011 at 16:07
  • Well, the problem is no.one knows what the attacker will try. Likewise, the attacker doesn't know anyone's character set. If lowercase dictionary words are the only trick, then anything outside of this characterset is equally likely to occur.
    – JoJo
    Jun 13, 2011 at 16:57
  • Far more relevant here is how the attack is being performed. "jbezlqw" is a 7-char password, which wouldn't take as long to crack using brute force as a longer, simpler password like "this is a secret". But that assumes a lot of things. For one, most interactive logins don't allow you to spam 1000 attempts per second, but a stolen hashed list would. The "secret" one is all lowercase and dictionary words with an obvious association, but does the attacker know that? Were they shoulder surfing? If so, you might type it more deliberately if it's complex, which is easier to see.
    – SirNickity
    Jan 26, 2022 at 0:13
11

If you have complex password, there is a chance that it won't be decoded when potential hacker downloads the database of users from server. Simple password stored as MD5 or other hash could be easily found in some hash database (on the other hand, even complex password could have matching hash collision too).

It is much faster to perform lowercase, 6 letter brute force attack on few thousands users hoping at least few passwords will be revealed, than trying to brute force one user using all the characters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .