# Password strength + special characters **URL:** \ **Category:** Factual Questions\ **Created:** [December 2, 2013, 12:31am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251 "2013-12-02T00:31:55Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 5, 2013, 5:26pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/41 "2013-12-05T17:26:31Z")
And as another [XKCD](http://xkcd.com/538/)strip suggests, beyond a certain point the effort to crack a password would be high enough that any scary people who want it could employ other methods. (the hovertext is probably also true). ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 5, 2013, 5:34pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/42 "2013-12-05T17:34:20Z")
> [@](#): > > Quoth **Ximenean** : > > I suppose that they would only use brute force on individual passwords thought to be valuable. I have not heard of any real-life incident where that has happened. If the site they’ve gotten the password file from is a bank, then _every_ individual password is valuable, to the tune of however much that user has in their bank account and lines of credit. And a reasonably-constrained brute force search will run plenty fast enough, even applied to every single account, to quickly get a large proportion of matches. Even more so, if you use something just a little smarter than brute force (using dictionary words, keyboard patterns, common letter substitutions, and so on). ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [December 5, 2013, 6:05pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/43 "2013-12-05T18:05:19Z")
> [@Honey](#): > > Password1, Password2 and so on. Yes, that is exactly what I do at work. I use an 8 digit word followed by a 2 digit number. When a special character is needed it goes between the word and the numbers. And when the password needs to be changed the number on the end goes up by one. Why? Because of the dozens of times I must log in each day I have got to have a password I can easily remember. You see some of the information on my screen is sensitive and personally identifiable, so they set the time-out for inactivity to about 5 minutes so that no one can see what you are working on if you step away from your computer. The office has a continual parade of people coming in with various issues and several co-workers are also in this same office. Log in to local machine, log in again thru a Citrix portal to the main computer located somewhere on the moon judging by the response time, login a 3rd time to each application I work in. But wait, someone has a question for me, so I take care of it and shit!! Access lost due to inactivity. Log in, log in, log in, start again, all fucking day. Log in, log in, log in, a few minutes of work and shit again! Fucking passwords, fucking log ins. I am looking forward to the day when biometrics will log me on as soon as I grab the mouse. Why yes, it is government work. How did you know? ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 5, 2013, 6:22pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/44 "2013-12-05T18:22:39Z")
> [@Chronos](#): > > If the site they’ve gotten the password file from is a bank, then _every_ individual password is valuable, to the tune of however much that user has in their bank account and lines of credit. My understanding is that major banks don’t use hashing for password security. They actually encrypt the password databases with separate, ultra-secret keys. So obtaining the password database wouldn’t be enough, you’d need the key(s) too. Banks have the means and experience to keep the necessary keys secret. Ordinary websites don’t, so for them hashing is a good, simpler solution. ---
**Author:** ![Learjeff](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@Learjeff](https://boards.straightdope.com/u/Learjeff)\ **Post date:** [December 5, 2013, 7:22pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/45 "2013-12-05T19:22:11Z")
> [@Ximenean](#): > > My understanding is that major banks don’t use hashing for password security. They actually encrypt the password databases with separate, ultra-secret keys. So obtaining the password database wouldn’t be enough, you’d need the key(s) too. Banks have the means and experience to keep the necessary keys secret. Ordinary websites don’t, so for them hashing is a good, simpler solution. I don’t think that quite works. First, this “ultra-secret key” would need to be used every time a password is validated. That’s the reason behind the typical scheme (ala UNIX) where the password file doesn’t need to be kept secret, but the passwords aren’t stored there: only the hash to verify the password is kept there. The hash doesn’t reveal the password (although as mentioned above, having it makes cracking the password easier). It _does_ make sense to encrypt the password file regardless, so that it’s not easy to get the list of user IDs. But as I mentioned above, it would need to be decoded frequently, to do the password check, which raises the likelihood of it being spied. Now, I would expect banks to use significantly more sophisticated systems than what I mentioned above. But a ‘super secret password’ doesn’t help, since it would need to be used so frequently. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [December 5, 2013, 7:24pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/46 "2013-12-05T19:24:45Z")
It seems to me that the chances of some scrote hacking the bank, stealing the password list and all the other information, cracking my password, security code and number, and then stealing my funds, are much lower than the chances that our local friendly burglar will break in and steal all my goods, including my computer. Or, even more likely, get mugged when I draw cash from an ATM. ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 5, 2013, 7:51pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/47 "2013-12-05T19:51:13Z")
> [@Learjeff](#): > > I don’t think that quite works. > > First, this “ultra-secret key” would need to be used every time a password is validated. Yes, that’s how I remember it. They had an outer system, still secure by the standards of your average website, which had encrypted passwords stored on it, and a specialised, heavily-protected and locked-down system, that had the encryption keys and was queried by the outer system to verify that the passwords were correct. Because the inner system didn’t have to do anything except store a few keys and check incoming passwords, it could be a simpler, one-purpose system and therefore easier to secure. ISTR there were also reasons involving network latency, can’t remember the details. The outer system was more like a regular server. ---
**Author:** ![Flyer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/flyer/32/7298_2.png) [@Flyer](https://boards.straightdope.com/u/Flyer)\ **Post date:** [December 5, 2013, 8:13pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/48 "2013-12-05T20:13:45Z")
> [@bouv](#): > > I’m guessing lots of sticky notes “cleverly” hidden underneath keyboards. I’ve never really understood why writing down a password is so frowned on in certain circles. If an attacker has **physical** access to your computer, you’ve very likely got much bigger problems than password issues. ---
**Author:** ![AHarris](https://avatars.discourse-cdn.com/v4/letter/a/bcef8e/32.png) [@AHarris](https://boards.straightdope.com/u/AHarris)\ **Post date:** [December 5, 2013, 8:48pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/49 "2013-12-05T20:48:04Z")
> [@Flyer](#): > > I’ve never really understood why writing down a password is so frowned on in certain circles. If an attacker has **physical** access to your computer, you’ve very likely got much bigger problems than password issues. Consider a public space or private office where hundreds of people have legitimate access to the computer’s physical location. It’s easy enough to lock everything down by user account, but if you’ve provided easy access to your password it’s easy to impersonate you and gain access to any data that you have access to. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 5, 2013, 8:52pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/50 "2013-12-05T20:52:54Z")
If you’re in a cubicle farm, then that just means that you should keep the little slip of paper in your wallet instead of stuck to your keyboard. People are generally pretty good about keeping their wallets secure. And if a bank wants to add extra layers of security to its password handling, that’s fine, as long as the extra layers are in addition to, not instead of, the standard ones. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [December 6, 2013, 12:56am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/51 "2013-12-06T00:56:18Z")
There have certainly been instances of old computers turning up at a tip or recycling depot with sticky notes listing passwords still attached to the screen. There is little doubt that the weak link in security has been the human, and this is something that is unlikely to change. ---
**Author:** ![bengangmo](https://avatars.discourse-cdn.com/v4/letter/b/50afbb/32.png) [@bengangmo](https://boards.straightdope.com/u/bengangmo)\ **Post date:** [December 6, 2013, 1:21am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/52 "2013-12-06T01:21:06Z")
> [@Learjeff](#): > > The risk is that someone targets your bank account and tries to guess the password. If they succeed, they take your money. > > How did they know about your account? Lots of possibilities, no doubt. For example, somehow the bank got hacked enough for them to get the password file. The password file does NOT allow someone to log in as you. But it does give them (a) the list of user account IDs, and (b) most of the info needed to try passwords on any computers (including thousands of home computers they took over using a virus) until they get some hits. > > So, they attack all the account IDs they have in hand. The accounts with the least safe passwords are the ones that’ll get drained first. Don’t be the owner of one of those! I know it does and has happened - but to me, a moderately strong password is good enough on my side. It’s the bank that needs the super security. And to me it makes sense when you think about it. Absent hacking of the bank, what does the super nerd criminal need to get access to my account? 1. He has to know I bank there 2. My self chosen, minimum 8 character username 3. My password I have five attempts before I’m (permanently) locked out and must either wait 1 week for the reset mailer to arrive or visit the bank personally. And even if the SNC gets past that - he still has to send the money somewhere. My bank doesn’t allow international transfers, (unless they are preset-up to a white list) - which means he has to have a local bank account. To open an account, he must have ID… And even then - we have 2 factor identification here, so after getting the password right, he still has to get past the 2nd factor dongle that generates an 8 digit onetime password. Meh - Frankly, I’m not going to get too concerned about leaving myself open to a dictionary attack by choosing a password like indoctrination83 Or to think about it another way - I used to work at a petrol kiosk / station. They were super vigilant about fuel spills. But as the safety officer pointed out to me… When we watch the pumps, then pump at what 50-60 litres a minute? How much can be spilled. When the tanker truck comes, he dumps 3000-5000 litres a minute Where should I spend my effort in being vigilant? ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 6, 2013, 1:48am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/53 "2013-12-06T01:48:47Z")
[edit] I changed my mind about posting this. ---
**Author:** ![Learjeff](https://avatars.discourse-cdn.com/v4/letter/l/94ad74/32.png) [@Learjeff](https://boards.straightdope.com/u/Learjeff)\ **Post date:** [December 6, 2013, 2:43am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/54 "2013-12-06T02:43:00Z")
> [@Ximenean](#): > > [edit] I changed my mind about posting this. That’s OK. I saw your password before you deleted it. You’d better move your funds. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [December 6, 2013, 2:46am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/55 "2013-12-06T02:46:38Z")
> [@Learjeff](#): > > That’s OK. I saw your password before you deleted it. You’d better move your funds. Too late, I’ve already snarfed them. 😃 ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [December 6, 2013, 2:51am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/56 "2013-12-06T02:51:14Z")
Well, enjoy that £1.50. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 6, 2013, 3:22am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/57 "2013-12-06T03:22:07Z")
> [@](#): > > Quoth **bengangmo** : > > I know it does and has happened - but to me, a moderately strong password is good enough on my side. It’s the bank that needs the super security. > > And to me it makes sense when you think about it. Absent hacking of the bank, what does the super nerd criminal need to get access to my account? Why absent that, though? Major financial institutions have been hacked in the past, and it will surely happen again. Also, you shouldn’t count on any security at all from knowing that you use that bank, or knowing what your user ID is. Those are both considered public knowledge. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [December 6, 2013, 4:33am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/58 "2013-12-06T04:33:23Z")
> [@Deeg](#): > > I think that the difference is so minor that the original password is plenty good enough. While it is true that ScroogeMcDuckHas$80Billion" could eventually be randomly guessed (via brute force dictionary attack) we’re still talking 100’s of years. A dictionary that includes common character names has got to have 100k’s of entries. “ScroogeMcDuck” is probably a single entry so the number of possible dictionary combinations is ~3^100k before we factor in “$80”. Unless Blaster Master is specifically targeted by the NSA he should be safe. If I was going to make a suggestion I’d recommend changing a single letter in Scrooge’s name, like “MxDuck”. The problem is that it’s a cat and mouse game. He may be safe _now_ but maybe not next year. For anyone curious about how actual crackers go about figuring out password, please take a look at [this article](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/). The problem is that when there’s a leak, and they happen often enough that you should assume that there _will_ be one, the password list gets spread to every single cracker on the planet who will then start working on it. If passphrase become popular, then crackers will adapt their techniques and dictionaries. No matter how long, how apparently obscure your password is, if it can be broken down into two parts that are in a dictionary, as possibly “ScroogeMcDuck” and “has$80Billion” are, then your password will be cracked. Crackers know all about obvious substitutions, so something random like “Scxooge” is actually stronger than “$cr00ge.” Is this paranoid? Somewhat. However, people are so bad at coming up with anything truly random that just advising people to use phrases won’t much improve their security. See in the article how the phrase-like password “momof3g8kids” fell rather easily. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [December 6, 2013, 4:44am UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/59 "2013-12-06T04:44:52Z")
> [@Flyer](#): > > I’ve never really understood why writing down a password is so frowned on in certain circles. If an attacker has **physical** access to your computer, you’ve very likely got much bigger problems than password issues. I think security experts are divided on this topic. Certainly, sticking a post-it on your workplace monitor or keyboard is stupid and defeats the purpose of passwords. However, as some note, people are much better and smarter when it comes to protecting their physical property, so that writing a good password (or even just part of the password) down on a piece of paper you keep in your wallet, while not perfect, is probably fairly safe. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [December 6, 2013, 2:58pm UTC](https://boards.straightdope.com/t/password-strength-special-characters/675251/60 "2013-12-06T14:58:53Z")
> [@](#): > > Is this paranoid? Somewhat. However, people are so bad at coming up with anything truly random… Well, we _can_ do it, and it’s not actually that hard. For instance, when I set up my online banking, I created my password by rolling dice. I guaran-damn-tee that that one’s random, and no cracker is guessing it. [Previous page](https://boards.straightdope.com/t/password-strength-special-characters/675251.md?page=2) [Next page](https://boards.straightdope.com/t/password-strength-special-characters/675251.md?page=4)