Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let's say one wants to encrypt a file using a passphrase (not a key), gpg can do that. Assuming a short passphrase, does it make sense to make use of a longer passphrase that is the short one concatenated many times?

Example:

Initial password:

foo

Long password:

foofoofoo... # many times

Is the long password stronger than the short one?

share|improve this question

closed as off-topic by random Jun 29 '13 at 12:31

  • This question does not appear to be about computer software or computer hardware within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Password strength is going to be dependent on how easy it is to crack. foo is a bad password. f0o is better. A combination of letters (upper and lower cast), numbers and symbols is best. F0of0oFo0 is better than foofoofoo. F0*f0oF*8 is better than F0of0oFo0. One rule of thumb is to never use dictionary words. –  Ben Plont Jun 28 '13 at 23:50
1  
"foo" was just a placeholder in my example, of course the initial passphrase can be strengthened like you suggest –  AnonymousLurker Jun 29 '13 at 0:04
    
I understand. I was just expanding on the idea of using letters on their own. –  Ben Plont Jun 29 '13 at 1:49

3 Answers 3

up vote 1 down vote accepted

Unfortunately it doesn't make sense. As @Scott said, while repeating the same password probably makes the key slightly more secure, it kind of defeats the purpose of using a passphrase over a key. I guess its analogous to using "1111" as a 4 digit pin as opposed to no pin at all.

Security.stackexchange is probably a better place for this question, and indeed has it, and has answered it - http://security.stackexchange.com/questions/31153/passphrase-using-same-word-several-times

share|improve this answer

Password strength can be measured using entropy. Depending on how your password is generated (length, different kind of characters ie. capitals, numerics, special characters, etc.), you get a weaker or a stronger password. Here is what Wikipedia says about Password strength:

It is usual in the computer industry to specify password strength in terms of information entropy, measured in bits, a concept from information theory. Instead of the number of guesses needed to find the password with certainty, the base-2 logarithm of that number is given, which is the number of "entropy bits" in a password. A password with, say, 42 bits of strength calculated in this way would be as strong as a string of 42 bits chosen randomly, say by a fair coin toss. Put another way, a password with 42 bits of strength would require 242 attempts to exhaust all possibilities during a brute force search. Thus, adding one bit of entropy to a password doubles the number of guesses required, which makes an attacker's task twice as difficult. On average, an attacker will have to try half the possible passwords before finding the correct one.

Since a picture is worth a thousand words, just read this strip from xkcd. You will get why it is not necessary to get a "complex" password, but a long enough easy to remember password can be preferable than a weaker complex password.

enter image description here

Finally, you can test the entropy of your password thanks to strength tests like this one. You'll noticed that the repetition of your initial password increases its entropy. Except if the hacker (or bruteforce algorithm) knows you're using repetition in your password generation, your password will be harder to guess.

share|improve this answer
    
This doesn't directly answer the question, but it's good advice nonetheless. It'd be better if you provided more than just a link, however. –  Bradd Szonye Jun 28 '13 at 23:49
1  
Welcome to Superuser.com. To attach a picture, you first save it to your computer. Then you press "control + G" then "Enter". Now you can browse to the picture you wanted people to see and select it. This will embed it in your response. It will take you an extra 15 seconds to do compared to posting a link, but people will actually see it in your response on this website without having to go to a 3rd party site. We hope you enjoy learning to use this site. –  Austin ''Danger'' Powers Jun 29 '13 at 0:00
    
Bradd, I edited my answer to provide some more information. @Austin, I was not comfortable with including a (potentially) copyrighted picture in my answer, I just checked and xkcd is under CC by-nc. –  ssssteffff Jun 29 '13 at 0:44

In the past year or two, I have seen several articles, posts, whatever, suggesting lengthening passwords (and/or passphrases) by appending to them, repetitively.  For example, foo might become foo77777 or foo#####.  Your idea is similar.  The bad guys probably read these same articles, and probably have updated their password-guessing software to anticipate such tricks.

So I would say the answer is, yes, foofoofoo is more secure than foo.  It might take the bad guy two minutes to crack it, rather than two seconds.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.