dictionary attack on passwords [closed]

Question

I am questioning the common advice given to not use dictionary words in a sentence for a password. For example using "My name is Sue!" as a password. On the websites I host and manage if you don't type that exact string of characters you are not getting in. I've looked at the dictionaires used by some cracking software and they are amazing collections of words. I quickly gave up trying to find a word that wasn't in there, in every written language. So using a Dutch swear word makes for lousy password. But, there were no phrases in there, and even if there were wouldn't the shear number of possible phrases and their permutations simply turn it into another form of brute force attack?

So, why the advise to not use dictionary words in a sentence for a pass phrase?

(soap box)I think IT has done users a disservice by requiring ever more complex and impossible to remember passwords rather than offering the advise to use a passphrase. I'm looking for a reasoned answer why I'm thinking incorrectly and should go back to the common advice.(/soap box)

Answer 1

You're comparing passwords to passphrases. Passphrases are generally regarded as superior, as long as people do not use common phrases.

Answer 2

As 'Ernie' already said you are comparing passwords with passphrases. The advice not to use dictionary words is solid. But using passphrases as a combination of dictionary words is only 'one step' less dangerous, as are other tricks trying to make a memorable password/phrase.

Nowadays, in the situation where an attacker has the encrypted version of your password(phrase), he will not just do an ordinary dictionary attack. The hackers know all the tricks (leetspeak, concatenating words, adding numbers etc).

Extended info in Security Now episode 366 "Password Cracking Update: The Death of 'Clever'" (or read its transcript).

I suggest you use a good password generator like LastPass (also entensively discussed in Security Now episode 256) to generate random passwords for you. Humans are bad at random (either generating it or detecting it)

If you really want memorable passwords, you might want to use the password haystacks technique as an alternative to hard to remember random combinations. Here you append a repetitive string (123 123 123) to a short string containing maximum entropy (D0g!).

Whatever method you choose, make your passwords at least 12 characters. All 8 character passwords can now be cracked in 13 hours on a build-it-yourself machine that costs $12000 (mainly for the GPUs)

Answer 3

How hard it is to brute force a password depends on at least two variables:

• Password length.
• Allowed password characters.

The first is obvious. If I limit myself to only letters (26 small+26 capital letters), then

1. A single letter password can be guessed in at most 52 attempts.
2. A two letter password can be guessed in at most 2704 attempts (52×52)
3. A three letter password can be guessed in at most 140608 attempts (52×52×52)

As you can see, the number of combinations rises rapidly. Therefore, the longer the password, the harder it is to brute force. IT should encourage long passwords.

However, many old applications only accept passwords up to a length of 8. This is simply too short for good security. If you are limited to such an 8 char. limit, or you know your users will not use long passwords, there is another way to make passwords harder to brute force: Make the password use a larger set of input than just letters. Add digits. Add strange things on the keyboard.

This is not a good solution. It is a workaround to compensate for the average user or for old systems. A password like BatteryHorseStaple (length 18) is a lot harder to crack than most short but complex passwords. However, most people will be too lazy to type that.

You might notice that I consistently used the term brute force a password and not crack a password. This is because there are other ways to discover someone’s passwords. E.g., you could just guess.

Dictionaries are nothing more than large lists of words to guess, and password cracking programs are smart enough to try variations of words in dictionaries.

This makes the words in such a dictionary unsuitable for both passwords and for the use in passphrases.