0

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ࡀ ,which I found under Mandaic and doesn't render properly in Firefox for me)? I understand that in theory, an attacker making a brute force attempt would probably determine the character space and use the entirety of the possible characters. But, is this common in password cracking software? Is it likely that someone would try bruteforcing a large character space, or more likely they go for the low hanging fruit of alphanumeric and maybe include special characters easily entered on a keyboard?

I understand that Security Through Obscurity Is Bad and relying on this as the sole method of choosing a password is a bad idea and I shouldn't choose a 1 character password with the assumption that no one would try my character. But I'm curious if anyone has information about how strong of a password something like "ᏯᏯᏯᏯᏯᏯᏯᏯ" would be based on how hackers actually work.

3

Technically, characters are just sequences of bytes. So while that character may look incredibly exotic to you, there's nothing special about it. It may occupy a few more bytes than, say, an ASCII character (depending on the encoding), but that's it.

Of course an attacker will probably start with the low-hanging fruit (words from a dictionary, digits-only, alphanumerics etc.). But after this, they may very well switch to raw bytes, and then the only thing which protects you is the actual entropy of your password. Where the bytes come from is irrelevant. Instead of your exotic Unicode characters, you might as well use an equal amount of ASCII chars.

Another problem with Unicode is that it's not fully supported by all applications. Some don't support it at all, others only support the BMP. That means there's a certain risk that your password will be mangled in some way -- if they're even accepted.

So to answer your question: Yes, there is a benefit if you assume that the attacker will only go after “standard characters”. But it's better to take care of the raw (byte-level) strength. For example, I usually generate 16 random bytes and encode them as 32 hexadecimal digits. This provides maximum security and compatibility at the same time.

  • @BobBrown But they can only look at the leading bits once they see the password, at which point they've already got it. – ganbustein Dec 23 '14 at 20:04
  • @ganbustein: Ummmm... you're right. Sorry! I'll wait a few hours, then delete my comment lest it confuse more than me. – Bob Brown Dec 23 '14 at 20:09
1

The larger you can make the search space, the better. The question is whether using obscure characters is practical. How many sites would even accept unusual characters? A cracker would probably have an easier time exploiting some vulnerability that gets him into the system than he would trying to brute force passwords. Having said that, making a password as long as possible is a more practical approach.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.