Hacker News Reader

Comment by chadgeidel | Hacker News Reader

As others have mentioned, I don't think "l33t" is going to help you there. Remember - a dictionary attack isn't based on "THE dictionary" (Websters et al.) but A dictionary. If I were to write a password cracker, the first thing I would do was take a list of common passwords and "l33tify" them (trivial) to create my cracking dictionary. Of course, this is still a brute force attack, and all that entails.

View on HN

But your dictionary just got a LOT bigger:

leetify:

1eetify 13etify 133tify 1337ify 133y!fy ... leetif/

You've added about 100 new words for that one old word. Of course you can do this programmatically, so your actual dictionary stays the same size, but your search is still 100x or more longer.

This isn't a hypothetical, such programs and dictionaries not only exist in the wild, but are easy to find.

I didn't suggest it was a hypothetical. But I wanted to be clear that its not like you double the size of a not l33tifi36 dictionary. Rather it becomes 100x larger. And depending on how many l33t variants you supports several thousand times larger.

th3quickbrownfoxjumpsov3rth314zydogsb4ck

silly, but at least it has length going for it

Right, and if the argument is that adding character classes adds complexity, then the 1337ed characters are not actually a different character class, they are equal to an existing one. "e" == "3" doesn't help, even if you have a "secret scheme" (as mentioned above). "secret," "s3cr3t," and "secr3t" are all equal in complexity except with raw brute force. Which this isn't, it's just a dictionary with some extra substitutable characters.

Reply on news.ycombinator.com