# How easily can a password-cracker break a long-sentence password? **URL:** \ **Category:** Factual Questions\ **Created:** [November 11, 2010, 7:18pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342 "2010-11-11T19:18:17Z")\ **Posts on this page:** 17\ **Page:** 2
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [November 12, 2010, 12:32am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/21 "2010-11-12T00:32:15Z")
> [@Skald\_the\_Rhymer](#): > > Seems to me a 41-character password of random characters is pointless unless being used by an android or Mr. Spock. You have to write it down. So? Write it down and keep it in your wallet. You more-or-less know how to secure your wallet, right? Thus, your password will be just as safe. Also, if your wallet isn’t safe, you almost certainly have much bigger problems than losing the passwords it contains. [This is Bruce Schneier’s advice, anyway, and I can’t find any flaws with his reasoning.](http://www.schneier.com/blog/archives/2005/06/write_down_your.html) **Note** , of course, that this doesn’t apply to passwords you want to keep _more securely_ than your Social Security number and driver’s license. If you know any such passwords, and I doubt you do, the best advice is probably to make them completely random, thousands of bits long, and store them on a USB thumb drive on a lanyard attached to either your clothing or your body. ---
**Author:** ![TimeWinder](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@TimeWinder](https://boards.straightdope.com/u/TimeWinder)\ **Post date:** [November 12, 2010, 12:51am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/22 "2010-11-12T00:51:51Z")
> [@Ximenean](#): > > I was just making a point. It’s a bit of a hobby horse of mine - you often see advice like “you need (say) a 12-character password to be secure”. But it depends how you construct those 12 characters. If you just join a couple of dictionary words together, that’s way, way less secure than other methods that introduce more randomness. You can’t just say “oh, my passphrase is 30 characters long, therefore it’s as secure as other 30-character passphrases”. Mathematically, yes. Practically speaking? I suspect two or three dictionary words stuck together is as secure as “&p4\*381]G” assuming that you don’t explicitly tell the attacker that you’re using a password of that form. Can you cite even one case where a “couple of dictionary words joined together” password was cracked by a dictionary attack (or similar?). I suppose it’s possible that after exhausting the dictionary, the attacker could then turn around and try every combination of two, but you’ve now gone from 80K or so possibilities to 80K squared possibilities, and that’s only for two words, and for the very small subset of passwords that are of this form. My guess is that the attacker either gives up after the dictionary (after all, they’ve usually got lots of accounts to try and hack, and they’ll get into some with just a dictionary attack), or they go to a symbol-combination approach at that point, looking for shorter, random passwords. And as has been mentioned, almost nobody does this anyway unless they’ve gotten a local copy of the password database. They’re far more likely these days to put up some semi-useful “free” service on the Internet that requires “free” registration, (or hack an existing insecure one that stores passwords in plaintext or somesuch), then try those username/password combinations on the good stuff. ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [November 12, 2010, 8:37am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/23 "2010-11-12T08:37:03Z")
While Rainbow tables can provide spectacular results, those results are gained at the cost of a massive amount of precomputing and space. To crack an eight character mixed case password with numbers requires a 1/2 Terabyte rainbow table, which is 16 times bigger than the table required for a 7 character password. 41 characters are currently unachievable for Rainbow tables. Unix systems use _Salt_ to defeat dictionary and Rainbow attacks. Basically, you add a short string (always the same) to the beginning of every password before hashing. It does not even matter if the salt string is known by an attacker - no password directly matches anything in the dictionary. The attacker could generate an entirely new dictionary/Rainbow table including the salt if they knew it, but it would take so long as to invalidate the exercise. This is one of the reasons for regular password changes - if the password is attacked by brute-force, by the time it has been cracked, the password is useless. Si ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [November 12, 2010, 7:19pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/24 "2010-11-12T19:19:20Z")
> [@Ruminator](#): > > That particular website is safe because it’s just a javascript loop that checks each character – no “submit” required. However, your overall point is valid because the typical web surfer wouldn’t be able to differentiate between a legitimate website vs a malicious one. Even so, I felt better altering my real “high security” password to use different but equivalent characters. ---
**Author:** ![SCSimmons](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@SCSimmons](https://boards.straightdope.com/u/SCSimmons)\ **Post date:** [November 12, 2010, 10:45pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/25 "2010-11-12T22:45:54Z")
> [@Ruminator](#): > > That particular website is safe because it’s just a javascript loop that checks each character – no “submit” required. However, your overall point is valid because the typical web surfer wouldn’t be able to differentiate between a legitimate website vs a malicious one. > [@control-z](#): > > Even so, I felt better altering my real “high security” password to use different but equivalent characters. Did you remember to throw a pinch of salt over your shoulder first, too? ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [November 13, 2010, 1:10pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/26 "2010-11-13T13:10:41Z")
> [@TimeWinder](#): > > Mathematically, yes. Practically speaking? I suspect two or three dictionary words stuck together is as secure as “&p4\*381]G” assuming that you don’t explicitly tell the attacker that you’re using a password of that form. I think it’s a general principle of cryptography that you assume that the attacker knows the general _form_ of the passphrase. Anything else is “security through obscurity”. That’s why I say that we should think in more general terms of symbols from a set of symbols, rather than the specific case of characters from the set of alphanumerical characters + punctuation. Assume that the attacker has a rough idea of what set of symbols you are choosing from. **Ruminator** , the question of how many English words there are is a knotty one. When you get up into the 50,000 - 100,000 range, you are including a huge number of very obscure words. The most obscure word in the OP’s example is probably “Pallas”, a proper noun, which nevertheless shows up in [OneLook’s](http://www.onelook.com/?w=palla?&scwo=1&sswo=1) “common words only” category. ---
**Author:** ![TimeWinder](https://avatars.discourse-cdn.com/v4/letter/t/bcef8e/32.png) [@TimeWinder](https://boards.straightdope.com/u/TimeWinder)\ **Post date:** [November 14, 2010, 11:22pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/27 "2010-11-14T23:22:18Z")
> [@Ximenean](#): > > I think it’s a general principle of cryptography that you assume that the attacker knows the general _form_ of the passphrase. Anything else is “security through obscurity”. You’re generalizing that statement _far_ too much. The “general form of the passphrase” for the vast majority of password sites is basically: “stream of typable characters of defined minimum and maximum lengths.” I’ve never seen one that tells you to use, say, three dictionary words concatenated. I agree that a site which did require that would be less secure (because it defines a smaller search space for the attacker), but that’s the opposite of what the OP’s asking, which is: if you use such a phrase in place of, say, a random string, are you reducing your security noticably? I still claim not: there are an infinite number of such possible simplifications (all numbers, letters first, then numbers, dictionary word + number, dictionary word backwards, dictionary word repeated, etc.), and once you get beyond the ones that are used by a significant fraction of the population (name, family/pet names, dictionary word, phone and SS numbers, dictionary word + 1 digit), that space will rapidly approach that of just doing symbol combinations. Besides, usually you have multiple accounts to attempt, and in such a case it’s almost always better to try to attack multiple accounts with simple passwords than to try and crack one account with hard ones. [A surprisingly large number of folks use “password” as their password, for example](http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time). (And by your definition _all_ passwords are security through obscurity–after all, the only thing protecting you is something that you know and others shouldn’t–your password.) ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [November 15, 2010, 12:14am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/28 "2010-11-15T00:14:40Z")
> [@](#): > > You’re generalizing that statement far too much. The “general form of the passphrase” for the vast majority of password sites is basically: “stream of typable characters of defined minimum and maximum lengths.” I’ve never seen one that tells you to use, say, three dictionary words concatenated. You don’t get that from knowledge of the site, but from knowledge of the user. For instance, anyone reading this thread (which could be anyone in the wide world) might reasonably guess that **Skald** ’s actual password, while not the specific phrase in the OP, is still a multi-word phrase. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [November 15, 2010, 2:12am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/29 "2010-11-15T02:12:01Z")
> [@SCSimmons](#): > > Did you remember to throw a pinch of salt over your shoulder first, too? It’s not a secure site and I don’t trust my Javascript knowledge enough to dissect exactly everything it does. I feel like it’s fine but really what’s the advantage of giving it my real password? ---
**Author:** ![Random\_Design](https://avatars.discourse-cdn.com/v4/letter/r/58f4c7/32.png) [@Random\_Design](https://boards.straightdope.com/u/Random_Design)\ **Post date:** [November 16, 2010, 10:13am UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/30 "2010-11-16T10:13:47Z")
> [@beowulff](#): > > Windows XP had a particularly weak password encryption system. Using several hundred megabytes of [Rainbow tables](http://en.wikipedia.org/wiki/Rainbow_table)and [Ophcrack](http://www.google.com/url?sa=t&source=web&cd=1&sqi=2&ved=0CBYQFjAA&url=http%3A%2F%2Fophcrack.sourceforge.net%2F&ei=mkvcTPfvEY2isAORk93lAw&usg=AFQjCNEUB8IFvkiTaD4jH8HEUhWzy_5iwg), I was able to crack the Admin password of a deceased friend’s computer in around 30 seconds. For no particular reason I decided to download ophcrack from that link, and AVG (2011) jumped to attention and claimed it was malware. Is this a case of overzealous AVG? ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [November 16, 2010, 3:25pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/31 "2010-11-16T15:25:04Z")
> [@Random\_Design](#): > > For no particular reason I decided to download ophcrack from that link, and AVG (2011) jumped to attention and claimed it was malware. Is this a case of overzealous AVG? Probably. AV programs seem to consider any sort of cracking or hacking tool malware. To me they really wouldn’t be malware unless they can be run in an automated fashion, but I guess it’s too difficult to make that distinction. ---
**Author:** ![Skald\_the\_Rhymer](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@Skald\_the\_Rhymer](https://boards.straightdope.com/u/Skald_the_Rhymer)\ **Post date:** [November 16, 2010, 4:41pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/32 "2010-11-16T16:41:58Z")
> [@Chronos](#): > > You don’t get that from knowledge of the site, but from knowledge of the user. For instance, anyone reading this thread (which could be anyone in the wide world) might reasonably guess that **Skald** ’s actual password, while not the specific phrase in the OP, is still a multi-word phrase. Which it isn’t, unless using initial letters of a mnemonic sentence (with symbols subsituting for some of the letters) counts. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [November 16, 2010, 6:01pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/33 "2010-11-16T18:01:48Z")
Impressive, **Skald** , you managed to simultaneously conclusively disprove and spectacularly prove my point, in a single-sentence post. ---
**Author:** ![Skald\_the\_Rhymer](https://avatars.discourse-cdn.com/v4/letter/s/ecccb3/32.png) [@Skald\_the\_Rhymer](https://boards.straightdope.com/u/Skald_the_Rhymer)\ **Post date:** [November 16, 2010, 6:30pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/34 "2010-11-16T18:30:07Z")
> [@Chronos](#): > > Impressive, **Skald** , you managed to simultaneously conclusively disprove and spectacularly prove my point, in a single-sentence post. I learned that from the Elves. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [November 16, 2010, 7:50pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/35 "2010-11-16T19:50:40Z")
Just an additional bit of fuel to the fire… crypto (and good password protection) are generally based on the concept of 'computational feasibility" - SHA has fallen victim to folks thinking it was secure; MD5 had a fail (via Playstation(s) - all attempts to encode a password are vulnerable. As Denis Leary said, “Life’s gonna’ suck when you grow up; it sucks pretty bad right now.” Same thing applies to InfoSec. ---
**Author:** ![Merijeek](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@Merijeek](https://boards.straightdope.com/u/Merijeek)\ **Post date:** [November 17, 2010, 1:25pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/36 "2010-11-17T13:25:36Z")
> [@GiantRat](#): > > Just an additional bit of fuel to the fire… crypto (and good password protection) are generally based on the concept of 'computational feasibility" - SHA has fallen victim to folks thinking it was secure; MD5 had a fail (via Playstation(s) - all attempts to encode a password are vulnerable. > > As Denis Leary said, “Life’s gonna’ suck when you grow up; it sucks pretty bad right now.” Same thing applies to InfoSec. My typical password is based on an obscure word. But it’s not, because while I thought it was a word…it wasn’t. So, yee haw. -Joe ---
**Author:** ![chrisk](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@chrisk](https://boards.straightdope.com/u/chrisk)\ **Post date:** [November 17, 2010, 1:36pm UTC](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342/37 "2010-11-17T13:36:12Z")
> [@Markxxx](#): > > There are programs used to crack passwords for Excel sheet sor rar files and they work but take an awfully long time. The longer the password the longer it takes, in General. Like for instance on the rar file cracker program it will give you choice, brute force, dictionary attack, combo, etc. If you take brute force it can take weeks. If you choose dictonary the program starts with, what it thinks, are the most common dictionary words and then goes from there. For excel, it doesn’t have to take a long time to crack the file, mostly because the ‘hashing’ system that Office uses is fairly limited - we have a quick routine that we use at work that doesn’t necessarily find the original password, but only takes a few minutes to find a password that will open up the file, by trying all distinct hash combinations. As I recall, the passwords that it generates are generally very long, with all of the characters except the last being ‘A’ or ‘B’, and the last can be any letter or some other characters. [Previous page](https://boards.straightdope.com/t/how-easily-can-a-password-cracker-break-a-long-sentence-password/560342.md?page=1)