# Using Dictonary Type Attacks On Passwords **URL:** \ **Category:** Factual Questions\ **Created:** [March 2, 2007, 4:33pm UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309 "2007-03-02T16:33:07Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Arnold\_Winkelried](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Arnold\_Winkelried](https://boards.straightdope.com/u/Arnold_Winkelried)\ **Post date:** [March 3, 2007, 4:44am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/21 "2007-03-03T04:44:18Z")
[QUOTE=groman] Well, by choosing a word, any word, you reduce the subset of characters to permute to try various password combinations. [/QUOTE] Sure, but then that wouldn’t be a dictionary type attack, right? I often see the suggestion of using “special” characters in your password, like @, !, $, #, etc., but there are so many varying rules as to which special characters are allowed in a password, depending on the security system, that I don’t bother with trying to use non-alpha numeric characters. ---
**Author:** ![Bryan\_Ekers](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bryan_ekers/32/183_2.png) [@Bryan\_Ekers](https://boards.straightdope.com/u/Bryan_Ekers)\ **Post date:** [March 3, 2007, 6:22am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/22 "2007-03-03T06:22:35Z")
[QUOTE=Arnold Winkelried] I don’t bother with trying to use non-alpha numeric characters. [/QUOTE] So, Arnold, did you have any beloved pets when you were younger…? ---
**Author:** ![OldGuy](https://avatars.discourse-cdn.com/v4/letter/o/3bc359/32.png) [@OldGuy](https://boards.straightdope.com/u/OldGuy)\ **Post date:** [March 3, 2007, 6:34am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/23 "2007-03-03T06:34:13Z")
[QUOTE=Sage Rat] With six characters, combining letters and numbers, plus uppercase and lowercase you have 6[sup]46[/sup] possible passwords (which appears to be a 36 digit, very large number.) [/QUOTE] Surely you mean 6[sup]62[/sup] which is a 49 digit number. Did you take 26 letters and add 10 lowercase and 10 uppercase numbers to get 46 rather than 26+26+10 = 62? ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [March 3, 2007, 6:35am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/24 "2007-03-03T06:35:37Z")
[QUOTE=sdguy] Makes sense, but why don’t websites do what this one does, if you try, say five times, and fail, you’re just locked out. That would esentially kill most dictionary type attacks because it would take a long long time, if you could only try five times a day. [/QUOTE] That was first used in Mainframe computers about 35 years ago. It is built into the Mainframe OS now, and automatically part of the system. You can adjust the number of password tries you get (3 is typical), but I don’t think it is even possible to completely turn this off. (I’ve certainly never seen a shop do this.) And on Mainframes, you can’t try again the next day. The lockout is permanent, and stays until you contact the security staff to get it reset. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [March 3, 2007, 6:43am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/25 "2007-03-03T06:43:57Z")
[QUOTE=OldGuy] Surely you mean 6[sup]62[/sup] which is a 49 digit number. Did you take 26 letters and add 10 lowercase and 10 uppercase numbers to get 46 rather than 26+26+10 = 62? [/QUOTE] ^ What he said. :o (I was falling asleep when I wrote that post.) ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [March 3, 2007, 6:51am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/26 "2007-03-03T06:51:31Z")
[QUOTE=Arnold Winkelried] Sure, but then that wouldn’t be a dictionary type attack, right? I often see the suggestion of using “special” characters in your password, like @, !, $, #, etc., but there are so many varying rules as to which special characters are allowed in a password, depending on the security system, that I don’t bother with trying to use non-alpha numeric characters. [/QUOTE] This is one of the main problems. Some password registration things only accept certain combinations of characters, which means that even if you do have a good strong password or three, periodically you’re forced to come up with a one-off for a particular service which you end up forgetting. A simple method of creating strong passwords is to combine two words connected by a number or character that has a meaning, and either has one word in all caps, both words beginning with a capital letter, or one word beginning with a capital. LOVE4goats Run2Store Batman\ **Author:** ![Arnold\_Winkelried](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Arnold\_Winkelried](https://boards.straightdope.com/u/Arnold_Winkelried)\ **Post date:** [March 3, 2007, 7:07am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/27 "2007-03-03T07:07:17Z") [QUOTE=Bryan Ekers] So, Arnold, did you have any beloved pets when you were younger…? [/QUOTE] Don’t remind me of the sad death of my favorite newt Rumplestiltskin Disraeli Boddingstons III. ☹ ---
**Author:** ![Arnold\_Winkelried](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Arnold\_Winkelried](https://boards.straightdope.com/u/Arnold_Winkelried)\ **Post date:** [March 3, 2007, 7:38am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/28 "2007-03-03T07:38:10Z")
[QUOTE=Sage Rat] A simple method of creating strong passwords is to combine two words connected by a number or character that has a meaning, and either has one word in all caps, both words beginning with a capital letter, or one word beginning with a capital. [/QUOTE] That’s a good method. Another algorithm that seems popular in password method recommendations these days is the “memorable phrase” approach, e.g. “I, Arnold Winkelried, joined the SDMB in October 1999” - use the first sentence from each word, password becomes something like iawjtsdmbio1999. ---
**Author:** ![groman](https://avatars.discourse-cdn.com/v4/letter/g/73ab20/32.png) [@groman](https://boards.straightdope.com/u/groman)\ **Post date:** [March 3, 2007, 7:52am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/29 "2007-03-03T07:52:06Z")
My biggest pet peeve is not which particular characters things accept, my biggest pet peeve is the requirement that the password be **between 6 and 8 characters**. This is idiotic. They never say this on the front page when you need to login, so even though I login to some of these sites several times a month every time I have to get my password reset. One of them disallows reuse of any of the past five passwords, and forces me to reset the password on three failed attempts. I don’t even bother writing them down or trying to remember anymore, I just use the password reset page as my login page. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [March 3, 2007, 8:42am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/30 "2007-03-03T08:42:46Z")
[QUOTE=OldGuy] Surely you mean 6[sup]62[/sup] which is a 49 digit number. Did you take 26 letters and add 10 lowercase and 10 uppercase numbers to get 46 rather than 26+26+10 = 62? [/QUOTE] Surely you really mean 62[sup]6[/sup] Each character can be one of 62, that’s 62 \* 62 \* 62, etc. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [March 3, 2007, 8:58am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/31 "2007-03-03T08:58:12Z")
[QUOTE=arseNal] root will always have access to the password file and can dictionary attack it all day long. [/QUOTE] On Unix. On an as400 you could not get to it. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [March 3, 2007, 9:17am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/32 "2007-03-03T09:17:58Z")
[QUOTE=RaftPeople] Surely you really mean 62[sup]6[/sup] Each character can be one of 62, that’s 62 \* 62 \* 62, etc. [/QUOTE] Gaudere appears to extend into math as well. You are correct. 62[sup]6[/sup] gives 56,800,235,584 possibilities. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [March 3, 2007, 7:48pm UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/33 "2007-03-03T19:48:35Z")
> [@](#): > > Sure, but then that wouldn’t be a dictionary type attack, right? > I often see the suggestion of using “special” characters in your password, like @, !, $, #, etc., but there are so many varying rules as to which special characters are allowed in a password, depending on the security system, that I don’t bother with trying to use non-alpha numeric characters. A few years ago, the University administration sent out a memo to everyone on campus, reminding us to use secure passwords for our Banner accounts (the system which handles all the university records). A good password, they said, should be at least eight characters long, and contain some each of upper-case not at the beginning of the word, lower-case, numbers, and symbols. Which would be good advice, except that the only passwords supported by the Banner system are numbers of exactly six digits. ---
**Author:** ![Will\_Repair](https://avatars.discourse-cdn.com/v4/letter/w/a698b9/32.png) [@Will\_Repair](https://boards.straightdope.com/u/Will_Repair)\ **Post date:** [March 3, 2007, 8:09pm UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/34 "2007-03-03T20:09:36Z")
[QUOTE=Arnold Winkelried] It seems to me that it would be pretty easy to circumvent a dictionary-style attack while still choosing a “simple” password. Just choose a word from a different language … [/QUOTE] First you run the attack with a dictionary file of the language used, (say English.) Then you run it with an English proper name file. Then you run it in, say, French in Canada or Spanish in US. Then … You’re only delaying the break-in. With a cut and paste you put the dictionary files together and start the attack until the program stops with a break-in. [QUOTE=Bricker] But if your password is “13Gr8Time$4Allz” he is still stymied. [/QUOTE] With faster and faster processing speeds this is becoming less secure. ---
**Author:** ![SmackFu](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@SmackFu](https://boards.straightdope.com/u/SmackFu)\ **Post date:** [March 3, 2007, 11:06pm UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/35 "2007-03-03T23:06:01Z")
This security policy opens up another kind of “attack”. You can effectively lock someone else out of their account just by trying to login as them constantly. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [March 4, 2007, 12:12am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/36 "2007-03-04T00:12:19Z")
[QUOTE=SmackFu] This security policy opens up another kind of “attack”. You can effectively lock someone else out of their account just by trying to login as them constantly. [/QUOTE] When this security was originated, it was on Mainframe systems, where terminals were hardwired to specific addresses. So if that kind of an attack occurred, the security people could look up the location of the terminal the logon attempts came from, walk down to that person’s office, and “speak” to him about it. That generally took care of the problem. ---
**Author:** ![Number](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/number/32/242_2.png) [@Number](https://boards.straightdope.com/u/Number)\ **Post date:** [March 4, 2007, 5:29am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/37 "2007-03-04T05:29:41Z")
[QUOTE=Arnold Winkelried] That’s a good method. Another algorithm that seems popular in password method recommendations these days is the “memorable phrase” approach, e.g. “I, Arnold Winkelried, joined the SDMB in October 1999” - use the first sentence from each word, password becomes something like iawjtsdmbio1999. [/QUOTE] Or, if you’re a good typist and you’re using a system that allows it, use the entire phrase including punctuation. Stick a number or symbol in the middle of one word. Even with valid dictionary words in the rest of it, it’s so long that it’s going to be nigh impossible to crack. ---
**Author:** ![Frylock](https://avatars.discourse-cdn.com/v4/letter/f/ce7236/32.png) [@Frylock](https://boards.straightdope.com/u/Frylock)\ **Post date:** [March 4, 2007, 7:23am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/38 "2007-03-04T07:23:24Z")
[QUOTE=the PC apeman] Yep. It surprised me too. [/QUOTE] I was thinking it must be that the hashing function isn’t one-to-one, in other words, that you can have more than one password that yields the same hash. But I don’t know anything about this stuff so I’m just guessing. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [March 4, 2007, 7:45am UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/39 "2007-03-04T07:45:30Z")
[QUOTE=Frylock] I was thinking it must be that the hashing function isn’t one-to-one, in other words, that you can have more than one password that yields the same hash. But I don’t know anything about this stuff so I’m just guessing. [/QUOTE] Theoretically, two passwords can hash to the same value, to be certain. Most hashes have enough bits in them though that this isn’t likely to ever happen though. The main thing though is that the username also needs to match, so it doesn’t matter if two different people have the same password, nor the same hash. ---
**Author:** ![Arnold\_Winkelried](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Arnold\_Winkelried](https://boards.straightdope.com/u/Arnold_Winkelried)\ **Post date:** [March 4, 2007, 3:41pm UTC](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309/40 "2007-03-04T15:41:34Z")
[QUOTE=Will Repair] First you run the attack with a dictionary file of the language used, (say English.) Then you run it with an English proper name file. Then you run it in, say, French in Canada or Spanish in US. Then … You’re only delaying the break-in. With a cut and paste you put the dictionary files together and start the attack until the program stops with a break-in. [/QUOTE] Well, in my example, though I didn’t emphasize it, I suggested an “unusual” language (icelandic or hungarian in the US for example.) If someone is that determined, they can probably crack my 5UPE4L33T!@# password also. [Previous page](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309.md?page=1) [Next page](https://boards.straightdope.com/t/using-dictonary-type-attacks-on-passwords/394309.md?page=3)