Hacker News Reader

Comment by Karunamon | Hacker News Reader

>Not a huge deal.

Wouldn't cutting your key search space roughly in half reduce your cracking time greatly, though?

According to Wolfram, for a 12 character password:

    password type | total number | example
    digits 0 through 9 | ~~ 2^40~~1 trillion | 287088364476
    case-insensitive alphabetic | ~~ 2^56~~95.43 quadrillion | ycwcgndabspw
    case-insensitive alphanumeric | ~~ 2^62~~4.738×10^18 | okcm5tfe8odr
    case-sensitive alphabetic | ~~ 2^68~~3.909×10^20 | SgilPtNTKmuQ
    case-sensitive alphanumeric | ~~ 2^71~~3.226×10^21 | xhWuSN5HBETz
    printable ASCII characters | ~~ 2^79~~4.759×10^23 | [i{}I"2Bz9sN

The difference comes out to be 6.7 bits of entropy for a 12 chraracter, case sensitive and case insensitive alphanumeric with symbols. 81.38 vs 88.08. (Note that this "bits of entropy" number is mostly beyond my comprehension.. could anyone elaborate a bit? I'd assume more==better)

View on HN

"reduce your cracking time greatly"

More characters is always numerically better... but better, as they say, is the enemy of good enough.

And "more ornerous" is the enemy of a paying casual userbase and doesn't help you at all vs the most common attack vectors (keyloggers and social).

Because of blizzard server limits you're not going to brute force login to my battlenet account even if I tell you my username and half of my password.

If you steal the hashes you're probably not going to be able to do anything with it because of work factor key lengthening and the fact that you have to attack each account one at a time.

Even then let's say you've managed to steal blizzards user/salt/hash databases and put a small country's GDP worth of GPU resources into breaking all the passwords. Now you come up against the fact that the vast majority of the accounts, including prohibitively all of the best ones, have 2 factor authentication.

Get past those 3 mission impossibles and you run into even more server side limits on IP logins. And logging in and doing anything on accounts takes time and blizzard's going to quickly figure out something is going on and put the whole thing on lockdown.

So yeah, not a huge deal imho.

...

"bits of entropy" is just the binary log of the character space, 81 bits -> 2^81.

I agree with Steko that being case insensitive is not a big deal. If you force users to use randomly generated passwords, 12+ characters is safe whether case sensitive or not.

On the other hand, if users choose their passwords themselves... Well I made a quick script to analyze the RockYou leak of 32 million plaintext passwords:

91% of passwords are lowercase

5% are uppercase

3% are lowercase but begin with a capital letter

In other words, you can crack 99% of case sensitive passwords just by trying these 3 possibilities!

Reply on news.ycombinator.com