# Password strength + special characters **URL:** \ **Category:** Factual Questions\ **Created:** [December 2, 2013, 12:31am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251 "2013-12-02T00:31:55Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Honey](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/honey/32/5074_2.png) [@Honey](https://boards.straightdope.com/u/Honey)\ **Post date:** [December 3, 2013, 7:18pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/21 "2013-12-03T19:18:45Z")
> [@Learjeff](#): > > Your way of dealing with those [expletive deleted] rules is a great example of how too many rules can lead to very bad passwords. Security fail! > > My employer requires us to change passwords every 6 months, and it can’t match any of the last 6 or 8 passwords. I bet you can guess what that leads to. Password1, Password2 and so on. ---
**Author:** ![Artemis\_Tardis](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Artemis\_Tardis](https://boards.straightdope.com/u/Artemis_Tardis)\ **Post date:** [December 3, 2013, 10:55pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/22 "2013-12-03T22:55:36Z")
But why do they put so much restrictions to create a long password to avoid the brute-force or dictionary attacks if they can use the system they use here on straightdope that blocks your log ins for x minutes after y failed attempts to log in? ---
**Author:** ![Canadjun](https://avatars.discourse-cdn.com/v4/letter/c/76d3ee/32.png) [@Canadjun](https://boards.straightdope.com/u/Canadjun)\ **Post date:** [December 3, 2013, 11:15pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/23 "2013-12-03T23:15:36Z")
> [@demian\_travis](#): > > But why do they put so much restrictions to create a long password to avoid the brute-force or dictionary attacks if they can use the system they use here on straightdope that blocks your log ins for x minutes after y failed attempts to log in? The attacks being talked about involve actually getting a copy of the account data including encrypted passwords as a file. Once that is obtained (by nefarious means that would be another discussion topic) the password cracker can take his time cracking the passwords; he doesn’t actually repeatedly attempt to log on to the system that the passwords belong to. ---
**Author:** ![bengangmo](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@bengangmo](https://boards.straightdope.com/u/bengangmo)\ **Post date:** [December 4, 2013, 1:20am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/24 "2013-12-04T01:20:47Z")
> [@Blaster\_Master](#): > > I think the XKCD comic linked upthread is one of the best, in terms of being both concise and informative, examples of why a lot of the complexity requirements on passwords are ridiculous and pointless. What ends up happening is where I might use “password” if I’m required to have capitals and numbers and special characters, it becomes “Password1!” which hardly adds anything to the computing time, just a constant factor and, in fact, anyone who knows the complexity requirements can fairly easily add a few extra steps. > > The problem is, when they do the entropy computations they make a bad assumption that passwords are random character choices from the available sets based on the complexity requirements, but that just isn’t the case. We have to have a password that is easy to remember or it’s essentially useless. And if we go with random-looking complex passwords along the lines of 1qaz@WSX3edc$RFV, keyboard patterns are also worked into any decent modern password cracker as part of the dictionary. > > That all said, I think the XKCD suggestion is generally good, but in some places, that isn’t possible because of complexity enforcement. So, instead, I’d recommend using pass phrases, that way you can include punctuation and capitalization naturally. The one constraint I would put on that is to avoid well known phrases as modern dictionary attacks are starting to include variations of famous quotes, move lines, etc. Instead, I try to think of something that I can easily associate with a particular site or service and have a phrase related to that. So, as a lame example, I might use a passphrase for a bank account along the lines of “ScroogeMcDuckHas$80Billion.” It’s easy to remember and associate with a bank, it naturally has multiple capital letters, lower case letters, 2 numbers and 2 special characters, it’s fairly long, and it’s not going to be hit by a dictionary or common phrase attack. > > So, beyond that, the other really big mistake people make is using the same password for multiple accounts. The problem there is, if you share those passwords, if any of those accounts get compromised, potentially any other account using the same password could also be compromised. I make sure to have distinct passwords for my primary email, bank, facebook, and a few other sensitive accounts, but I do share passwords for accounts that I don’t care if they get compromised, mostly the sorts of websites where they require an account for some reason and I probably even use a bogus email for it anyway. > > Anyway, though, I think password complexity requirements are, in general, a sense of false security. I’d rather just see us educate people on good password practice or, better yet, work toward using other methods of authentication, like password managers or two-factor authentication. For the accounts that require a password, but that I don’t really care about the security of (for example, those that use 2factor identification, or things that just don’t matter - like this message board) I use variations of names of my family plus a number For accounts that I want to keep secure I use a short pass phrase with capitlisation and a number… eg: MyGirlfriendIsPretty266 then when I changed it, the new password became mYolDgirlfrienDgoTfaT622 (no these are not the actual passwords) May not by all that secure against a brute force dictionary account - but seriously - I don’t keep nuclear secrets either. If someone goes to enough effort to break that password for my work facebook account - hell, they’re welcome to the rewards. ---
**Author:** ![Artemis\_Tardis](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Artemis\_Tardis](https://boards.straightdope.com/u/Artemis_Tardis)\ **Post date:** [December 4, 2013, 1:23am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/25 "2013-12-04T01:23:35Z")
> [@Canadjun](#): > > The attacks being talked about involve actually getting a copy of the account data including encrypted passwords as a file. Once that is obtained (by nefarious means that would be another discussion topic) the password cracker can take his time cracking the passwords; he doesn’t actually repeatedly attempt to log on to the system that the passwords belong to. What about using stronger cryptography on the passwords list and adding a lot of fake ones to make it harder to find the correct ones? If this is really stupid please ignore. Black Friday sold me cheap jack daniels (cheap here in Brazil). ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [December 4, 2013, 2:31am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/26 "2013-12-04T02:31:08Z")
Basically any password that’s not dictionary-hackable\* is equally secure based on the possible search space. That is, if one site **allows** (not requires) special characters, caps, numbers, etc, then aefbnkjt is roughly\*\* equally secure compared to AeFbnkJt or aef–0\*n. However, aefbnkjt suddenly becomes less secure on a site that only allows lowercase alphanumeric characters, simply because there are fewer things to try. One caveat is that longer passwords will take longer to crack in a given space (aefbnkjt will take less time to crack than aefbnkjti), but at a certain threshold you’re basically just needlessly increasing complexity from “won’t be found until 3000 years from now” to “won’t be found until the heat death of the universe” to “won’t be found until the heat death of the universe \* 2” and so on. This is assuming pure brute force and there’s no heuristics used to try the most common password lengths first, or using info on how humans suck at being truly random or whatever else, but I suspect such heuristics wouldn’t make a noticeable dent in a decently long password. I can’t remember who said it upthread (Chronos?), but it’s definitely true that constraining the state space at all (such as requiring at least n special characters, or forcing the first one to be alphanumeric or whatever else) will theoretically decrease the time it takes to crack it. Of course, as always, the best way to hack any computer is to call the dumbest employee and pretend to be from the password safety and inspection committee, requesting their password in order to ensure compliance with good safety standards. 😛 - “Dictionary-hackable” used loosely to include common permutations like passw0rd or common non-words like asdfghj or 12345 \*\* I say “roughly” because brute force algorithms would likely use a relatively predictable test order, aaaaaaa would probably be guessed before aaaaaab because of natural ordering and such, but for all intents and purposes they’re equally secure. > [@demian\_travis](#): > > What about using stronger cryptography on the passwords list and adding a lot of fake ones to make it harder to find the correct ones? > > If this is really stupid please ignore. Black Friday sold me cheap jack daniels (cheap here in Brazil). “Stronger cryptography” doesn’t really mean much. We use pretty strong algorithms already, and inventing new ones is really, really, really hard. Even then, there’s a speed/space/safety tradeoff. Using a password algorithm that takes 20 minutes to run and hashes each password to a 20GB sized footprint may be really secure, but not very practical. As for fake passwords, if you give each “user” a list of fake passwords, there are several problems I can think of with it, but it depends on exactly what you mean. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [December 4, 2013, 2:45am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/27 "2013-12-04T02:45:20Z")
> [@Honey](#): > > Password1, Password2 and so on. My university actually had some heuristics or something that could determine “similarity” between old passwords based on the hashes. (I’m not clear exactly how it was done, but I know for sure passwords weren’t stored in plaintext anywhere) It would also compare it to various dictionary words and common passwords before accepting it. So every year when you had to change your password you couldn’t use any dictionary words (okay, whatever), and you had to be very careful to not tickle a password it deemed “similar” to any of your last 4-5 passwords. I suppose it’s relatively secure in theory, but it took me forever to write a new password. The “similarity detection” was perhaps a bit more sensitive than it needed to be. Sometimes just two characters in similar places would tickle it. The biggest problem is that while I forced myself to memorize my password ASAP, I imagine there were a lot of sticky notes with passwords floating around the school. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 4, 2013, 6:36pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/28 "2013-12-04T18:36:50Z")
> [@](#): > > My university actually had some heuristics or something that could determine “similarity” between old passwords based on the hashes. (I’m not clear exactly how it was done, but I know for sure passwords weren’t stored in plaintext anywhere) It would also compare it to various dictionary words and common passwords before accepting it. So every year when you had to change your password you couldn’t use any dictionary words (okay, whatever), and you had to be very careful to not tickle a password it deemed “similar” to any of your last 4-5 passwords. Quoth **Jragon** : That’s definitely bad security. One of the requirements for a good hashing algorithm is that it be impossible to do exactly that. Think about it: If the school can test the hashes that way to see that the new password is “close”, then an attacker guessing the password can also tell when he’s getting close. And that’s if they were actually using hashes at all: The most likely method for doing that is just to store the past five passwords in plaintext somewhere (maybe in addition to a properly-secured hashed file, but that doesn’t matter if the plaintext exists). > [@](#): > > Basically any password that’s not dictionary-hackable\* is equally secure based on the possible search space. > > That is, if one site allows (not requires) special characters, caps, numbers, etc, then aefbnkjt is roughly\*\* equally secure compared to AeFbnkJt or aef–0\*n. However, aefbnkjt suddenly becomes less secure on a site that only allows lowercase alphanumeric characters, simply because there are fewer things to try. This is not true. If an attacker has a brute-force cracker that’s fast enough to find all passwords of, say, 8 characters restricted to lower-case letters, and he finds a site that allows passwords to contain upper-case characters, numbers, and symbols, he’s not going to just give up and say “Eh, the search space is too big”. He’s going to run his brute-force program anyway. It won’t get him all the passwords, but it will still get him the password of everyone who didn’t bother to use any of those special characters. He’ll only be foiled if the site actually _requires_ at least one of the characters he’s not using… And even then, a lot of folks are just going to include one single character to meet the requirements, and that character is often going to be at the beginning or end of the word, and the search space for “passwords with exactly one special character” isn’t all that much larger than the search space for “passwords with no special characters”, so an attacker can just use a slightly more sophisticated brute-forcer and still get in. ---
**Author:** ![JerrySTL](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@JerrySTL](https://boards.straightdope.com/u/JerrySTL)\ **Post date:** [December 4, 2013, 6:52pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/29 "2013-12-04T18:52:04Z")
I read recently, maybe in Wired Magazine, that hackers have analyzed the passwords which they have stolen from various sources to see which are used most often. That way they can put passwords such as “Pa$$w0rd” or even “password1” at the top of a dictionary attack. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [December 4, 2013, 10:38pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/30 "2013-12-04T22:38:56Z")
> [@Chronos](#): > > Quoth **Jragon** : > This is not true. If an attacker has a brute-force cracker that’s fast enough to find all passwords of, say, 8 characters restricted to lower-case letters, and he finds a site that allows passwords to contain upper-case characters, numbers, and symbols, he’s not going to just give up and say “Eh, the search space is too big”. He’s going to run his brute-force program anyway. It won’t get him all the passwords, but it will still get him the password of everyone who didn’t bother to use any of those special characters. > > He’ll only be foiled if the site actually _requires_ at least one of the characters he’s not using… And even then, a lot of folks are just going to include one single character to meet the requirements, and that character is often going to be at the beginning or end of the word, and the search space for “passwords with exactly one special character” isn’t all that much larger than the search space for “passwords with no special characters”, so an attacker can just use a slightly more sophisticated brute-forcer and still get in. That’s only because we have a bunch of priors about passwords. In black-box terms, the set of the alphabet is no more or less arbitrary than testing all passwords with any permutation of the characters {a,x,n,t,-,7,B}. We just know from experience that the lowercase alphabet is a common set to draw passwords from. In absolute counting terms, introducing constraints lowers the total number of possibilities. Maybe it’s not practical advice since any hacker will be drawing from those priors when writing their attack, but it is true that introducing no extra constraints has less possible candidates than one with extra constraints. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [December 5, 2013, 8:50am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/31 "2013-12-05T08:50:10Z")
> [@Blaster\_Master](#): > > So, as a lame example, I might use a passphrase for a bank account along the lines of “ScroogeMcDuckHas$80Billion.” It’s easy to remember and associate with a bank, it naturally has multiple capital letters, lower case letters, 2 numbers and 2 special characters, it’s fairly long, and it’s not going to be hit by a dictionary or common phrase attack. You would think so and you would be wrong (maybe). What makes a password secure is how unexpected each element is. In your example there is no surprise. “ScroogeMcDuck”, “McDuckHas”, “Has$80”, “$80Billion” are all common word pairs. What you need to do is take a phrase like that and change some words so that it’s still easy to remember but has uncommon pairs. “Lil’sisMcDuckHas531Burritos,” where “531” is a meaningful number for you is far, far harder to crack because neither “Lil’sisMcDuck” nor “531Burritos” are common pairs. ---
**Author:** ![drewtwo99](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@drewtwo99](https://boards.straightdope.com/u/drewtwo99)\ **Post date:** [December 5, 2013, 10:30am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/32 "2013-12-05T10:30:54Z")
Yeah if you’re going to do word passwords, make sure they don’t make any grammatical sense in english. Noun Adverb Verb Adjective Noun [BoyQuicklyEatsHotSoup] is an expected structure in English. But Verb Adjective Adverb Noun Noun [EatsHotQuicklyBoySoup], not so much, and isn’t that much harder to remember. HasScrooge$80McDuckBillion, for example, would be better and not that much harder to remember. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [December 5, 2013, 10:59am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/33 "2013-12-05T10:59:25Z")
My bank requires me to enter a 9 digit number, followed by a password, followed by three digits from a 'memorable phrase. I looked up their suggestions for a secure password: > [@](#): > > Tips for creating a secure password > > The longer the safer > Try using the first letters of each word from a made up phrase, sentence or song. For example the sentence “Long and complex passwords are safest, I keep mine secret” becomes “lacpasikms” > Try swapping some letters for numbers or insert numbers in between. For example “lacpas1210ikms” > Or try combining 2 unrelated items such as a memorable address with a car registration or birthday (not your own) > Avoid using plain words in any language because they’re more vulnerable > Avoid repetition and obvious sequences like ‘123456’, ‘2222222’, ‘abcdefg’ > 6 – 15 characters, including letters and numbers. I took their advice. My question is - What’s the risk? Is it that someone will hack the bank and get all the passwords - unlikely I hope. Is it that someone will hack my computer, or my internet connection? How and why? Is it that someone will steal my computer and try to get into my bank account? This seems the most likely and I make sure to wipe all links off before I go on holiday for instance. ---
**Author:** ![Learjeff](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@Learjeff](https://boards.straightdope.com/u/Learjeff)\ **Post date:** [December 5, 2013, 3:01pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/34 "2013-12-05T15:01:03Z")
The risk is that someone targets your bank account and tries to guess the password. If they succeed, they take your money. How did they know about your account? Lots of possibilities, no doubt. For example, somehow the bank got hacked enough for them to get the password file. The password file does NOT allow someone to log in as you. But it does give them (a) the list of user account IDs, and (b) most of the info needed to try passwords on any computers (including thousands of home computers they took over using a virus) until they get some hits. So, they attack all the account IDs they have in hand. The accounts with the least safe passwords are the ones that’ll get drained first. Don’t be the owner of one of those! ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [December 5, 2013, 4:02pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/35 "2013-12-05T16:02:54Z")
I am at a loss to explain how brute force cracking of a single account is likely to work for anything but the most common passwords like “password” or “123456”. Every data entry routine used today, AFAIK, limits the number of successive tries to just a few per hour, like 5. Guess wrong 5 times, you’re locked out for another hour. And these same systems often do more than just that – try again for 5 times, you may be permanently locked out until an administrator is summoned. Too many hacking tries, your account is flagged for special security treatment. Wouldn’t that pretty much eliminate brute force hacking? Or is the brute force attack expected to be used on an encrypted list? If so, that’s an extra layer of protection – you’ve got to get the list first. And even if you crack the first one in the list, you have to start fresh for the second. It would be pretty time-consuming to process a million names. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 5, 2013, 4:15pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/36 "2013-12-05T16:15:56Z")
You always want multiple layers of security. Obviously, the bank wants to take steps to prevent anyone from stealing the password file… but it still happens occasionally. Even if it does, though, so long as the bank set up the password system properly, and you chose a good password, your account is still safe. One layer of security failed, but the second still holds. ---
**Author:** ![Learjeff](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@Learjeff](https://boards.straightdope.com/u/Learjeff)\ **Post date:** [December 5, 2013, 4:19pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/37 "2013-12-05T16:19:12Z")
> [@Musicat](#): > > I am at a loss to explain how brute force cracking of a single account is likely to work for anything but the most common passwords like “password” or “123456”. Every data entry routine used today, AFAIK, limits the number of successive tries to just a few per hour, like 5. Guess wrong 5 times, you’re locked out for another hour. This was already answered above: many attacks happen when the password file is compromised, so the tests can be done without using the actual service. There are other cases where failures don’t cause blocks. I confess I don’t quite understand that, but I know I’ve seen it, and I got the impression that it was necessary for some reason, and not just lax security policy. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 5, 2013, 4:21pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/38 "2013-12-05T16:21:00Z")
> [@](#): > > It would be pretty time-consuming to process a million names. That depends on how good the users were about password security, and how many passwords the attackers want to crack. Given 24 hours and a typical home computer, you could probably get over half of those million names. ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 5, 2013, 4:26pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/39 "2013-12-05T16:26:26Z")
> [@Musicat](#): > > Or is the brute force attack expected to be used on an encrypted list? If so, that’s an extra layer of protection – you’ve got to get the list first. And even if you crack the first one in the list, you have to start fresh for the second. It would be pretty time-consuming to process a million names. They would use pre-computed attacks - dictionaries of hashes of common passwords, or rainbow tables. However, those attacks don’t work against a properly hashed and salted password database. In that case, brute force is the only option [ETA - or rather, trying the entire dictionary against every password, one by one] (or trying to find a flaw in the hashing algorithm - some older algorithms that are still in use have been found to be flawed). I suppose that they would only use brute force on individual passwords thought to be valuable. I have not heard of any real-life incident where that has happened. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [December 5, 2013, 4:45pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/40 "2013-12-05T16:45:45Z")
> [@jovan](#): > > You would think so and you would be wrong (maybe). What makes a password secure is how unexpected each element is. In your example there is no surprise. “ScroogeMcDuck”, “McDuckHas”, “Has$80”, “$80Billion” are all common word pairs. What you need to do is take a phrase like that and change some words so that it’s still easy to remember but has uncommon pairs. “Lil’sisMcDuckHas531Burritos,” where “531” is a meaningful number for you is far, far harder to crack because neither “Lil’sisMcDuck” nor “531Burritos” are common pairs. I think that the difference is so minor that the original password is plenty good enough. While it is true that ScroogeMcDuckHas$80Billion" could eventually be randomly guessed (via brute force dictionary attack) we’re still talking 100’s of years. A dictionary that includes common character names has got to have 100k’s of entries. “ScroogeMcDuck” is probably a single entry so the number of possible dictionary combinations is ~3^100k before we factor in “$80”. Unless Blaster Master is specifically targeted by the NSA he should be safe. If I was going to make a suggestion I’d recommend changing a single letter in Scrooge’s name, like “MxDuck”. [Previous page](https://boards.straightdope.com/t/password-strength-special-characters/675251.md?page=1) [Next page](https://boards.straightdope.com/t/password-strength-special-characters/675251.md?page=3)