Dictionary Word as Substring of Password?

Question

I know that having a dictionary word as your password is considered insecure. I believe this even extends to passwords of the form password123 or p@ssw0rd. Does this apply if some substring of the password is a dictionary word? For instance, fghpassword123 is obviously not in the dictionary, but the substring password is.

I don't know a whole lot about password security, but I believe the entropy is pretty important. However, I don't know if such a pattern would negate the added benefit of the password entropy.

Answer 1

In my personal experience working as a pentester, unless I was specifically targeting your account, the dictionaries I typically use when brute forcing lists of user accounts generally covered a list of common dictionary words, common 1337-style number substitutions (3 for E e.g.) and SOME common phrases.

Hackers and security groups actually do statistical analyses of actual passwords (like those disclosed from data breaches) and use the results to add new passwords to the list of passwords to use.

If I am specifically targeting your account, then I use more complicated password generator options, like simple dictionary, compound dictionary (putting 2 or more words from the dictionary together), 1337 substitution, or other common tricks, like I'll have each password tried with a ! at the end as this is the most common location to put special characters, and this is the most common special character.

I see dictionary word as substring as less of an issue than far more common password weaknesses. The three biggest things you can do to increase the security of your password is to:

1. mix in multiple character classes (upper, lower, number, special chars)
2. LENGTH!! (min. 9 chars)
3. Don't use secure passwords on insecure sites (so that wellsfargo != sony :-) )

Answer 2

It all depends on what type of dictionary cracker the hacker is using. It would not be too difficult to code for words as a substring, but neither is it widely done.

Don't do it, but its not the end of the word in other words.