# Why are alphabetic passwords weaker? **URL:** \ **Category:** Factual Questions\ **Created:** [August 26, 2014, 5:10am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540 "2014-08-26T05:10:44Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![Pleonast](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pleonast/32/1183_2.png) [@Pleonast](https://boards.straightdope.com/u/Pleonast)\ **Post date:** [August 26, 2014, 10:24pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/21 "2014-08-26T22:24:53Z")
What is the purpose of a maximum password length? I’ve been on websites which do not allow passwords longer than 12, 14, 16 characters, etc. On other hand, I have at least one account that allows up to 64-character passwords. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [August 26, 2014, 10:32pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/22 "2014-08-26T22:32:04Z")
> [@Pleonast](#): > > What is the purpose of a maximum password length? It helps identify sites with questionable security practices. As does a rule excluding certain punctuation characters. A site that correctly hashes passwords has no reason to set a short limit on length or prohibit common characters. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [August 26, 2014, 10:35pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/23 "2014-08-26T22:35:24Z")
> [@Pleonast](#): > > What is the purpose of a maximum password length? I’ve been on websites which do not allow passwords longer than 12, 14, 16 characters, etc. On other hand, I have at least one account that allows up to 64-character passwords. They should be storing hashes of passwords, not full passwords, so there should be no space gains. You do want to have at least some limit to length, to protect against memory issues, but allowing users 40-100 characters should always be reasonable. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [August 26, 2014, 11:10pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/24 "2014-08-26T23:10:11Z")
So - most sites, including this one I think, allow a forgetful user to recover their password. All I have to do is to give my email address and they automatically send it to me. I have done this with ebay on several occasions. If a criminal hacks my email (surely not all that difficult?) they can the easily get any passwords they want. The only exceptions that I know of for certain are my bank and my credit card company. ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [August 26, 2014, 11:21pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/25 "2014-08-26T23:21:59Z")
> [@Urbanredneck](#): > > I get frustrated at work when you have to change your password every 6 months and it gets hard to keep track of the change. We have to change passwords at work every 60 calendar days. The password history is 24 iterations. The standard rule is a minimum 12 characters (some require 32 characters!); it must include at at least one upper-case letter, at least one number, and one special character (from a list). I have about a dozen accounts to to change. I record everything in a [KeePass Password Safe](http://keepass.info/) on an encrypted flash drive. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [August 27, 2014, 12:04am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/26 "2014-08-27T00:04:03Z")
> [@bob\_2](#): > > So - most sites, including this one I think, allow a forgetful user to recover their password. All I have to do is to give my email address and they automatically send it to me. I have done this with ebay on several occasions. > > If a criminal hacks my email (surely not all that difficult?) they can the easily get any passwords they want. The only exceptions that I know of for certain are my bank and my credit card company. If you’re remembering that Ebay sent your old password to you in email, I think you’re mistaken. That would mean they’re storing passwords in the clear, which is negligent and doomed to disaster. There are sites that do, but they’re not high value targets like Ebay (and it’s only a matter of time before they change or die). You are correct that if someone hacks your email account, you’re screwed. This is why you need strong passwords that are unique and never reused across sites. If you think your email account is an easy target, **change your password now**. And enable [2-step authentication](https://support.google.com/accounts/answer/180744?hl=en). ---
**Author:** ![pdunderhill](https://avatars.discourse-cdn.com/v4/letter/p/4bbf92/32.png) [@pdunderhill](https://boards.straightdope.com/u/pdunderhill)\ **Post date:** [August 27, 2014, 12:32am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/27 "2014-08-27T00:32:17Z")
Hello All, Fascinating discussion re Password strength/length/practicability. A couple of points, one previously mentioned, come to mind. Password character sets and string lengths are frequently limited in/on(?), financial sites I think some Banks want the economy of on-line banking combined with the implicit dismissal of on-line fraud excused with ‘your password was insecure’, this combined with say an eight symbol limit seems to leave certain companies with a get out excuse. To whit: 1 We want to encourage on-line Banking, it’s cheaper for us. 2.We want to make it as accessible as possible to our Customers, ie better deposit rates, and boy I’m after every 0.15% 3. You, the Customer, are not only responsible for your own mistakes but ours as well. 4.We will limit the strength of any password you can apply, see #3 5.We will only admit to Database loss when forced. 5a. We will prevaricate, dissemble, lie hold ‘urgent discussions’, discuss ‘Blue Sky’ solutions (my favorite meaningless statement) and when finally all current members of the Board have bailed out with nice fat Lemonade, Bribes or Pensions admit defeat. 6.Pay for all of the above via a workers Pension Scheme. Peter ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 27, 2014, 4:33am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/28 "2014-08-27T04:33:20Z")
To be clear, I did not mean to suggest that an attacker would receive feedback on a partial-match password. What I meant is that any attack vector which will try “thisisreallyquitealong” will also try “thisisreallyquitealongpassword”. > [@](#): > > Quoth **Sage Rat** : > > And heuristics on word pairings are only useful if you know that most users use full sentences. If some users use random nouns, others write sentences, yet others write in l33t, and so on, optimizing your technique is unlikely to be all that useful. There probably isn’t any single technique that “most users” use. Any attacker is going to go after the low-hanging fruit first: The people who use “123”, or “password”, or their username or the name of the site. And there are a fair number of those. But they’re not going to stop there. After they finish those, they’re going to move on to trying their dictionary, and trying their dictionary with l33t substitutions, and trying short concatenations from their dictionary, and trying long but meaningful concatenations, and every other pattern they can think of. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [August 28, 2014, 6:13am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/29 "2014-08-28T06:13:09Z")
> [@bob\_2](#): > > My other pet peeve, is that websites don’t let us see what we are typing when we enter a password. That should be the default certainly, but those of us who are generally alone at our computers should be able to switch it off. If you use the firefox browser, there is an available add-on called PassLikeW8 that does this. It adds a little eye symbol to password fields; if you click on the symbol the \*\*\*\*\*'s in the field change to the actual text. ---
**Author:** ![septimus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/septimus/32/410_2.png) [@septimus](https://boards.straightdope.com/u/septimus)\ **Post date:** [August 28, 2014, 6:37am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/30 "2014-08-28T06:37:46Z")
> [@Sage\_Rat](#): > > Short of finding a piece of paper that’s been cut off, there’s no case where the cracker knows that part of the password is “thisisreallyquitealong”. Security software is unlikely to send back “hotter” and “colder” signals as hackers try different passwords, after all. Until you get a perfect match for the whole password, the software just tells you, “No”. I’m sure **Sage Rat** is correct regarding 21st century but … [boring historical note] There was a way to crack passwords on Vax/VMS based on “cut-off pieces of paper.” The VMS password software checked character by character. Place an ‘A’ in the _very last byte_ of your address space, point to it, invoke the password checker. If you get “Wrong password” you know the ‘A’ is wrong; otherwise you get “Address violation.” Iterate up to 26 times and you have the first letter, say ‘S’. Now place ‘SA’ in the last _two_ bytes, iterate up to 26 times to get the second letter of the password, and so on. [/boring] ---
**Author:** ![RivkahChaya](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rivkahchaya/32/8919_2.png) [@RivkahChaya](https://boards.straightdope.com/u/RivkahChaya)\ **Post date:** [August 28, 2014, 6:54am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/31 "2014-08-28T06:54:04Z")
> [@bob\_2](#): > > So - most sites, including this one I think, allow a forgetful user to recover their password. All I have to do is to give my email address and they automatically send it to me. I have done this with ebay on several occasions. > > If a criminal hacks my email (surely not all that difficult?) they can the easily get any passwords they want. The only exceptions that I know of for certain are my bank and my credit card company. The security questions for password recovery, like “What city was your high school in?” are ridiculously easy to look up. My brother answers all these with a code word, like for his Mastercard, the answer to every challenge question might be “fish.” One problem with the forced digits is that almost everyone, when forced to add digits, adds their age or birth year. If someone is trying to crack a particular persons password, you can look up this info. If you are cracking batches, you can go with common numbers for the sites demographic. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [August 28, 2014, 7:17am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/32 "2014-08-28T07:17:27Z")
> [@RivkahChaya](#): > > The security questions for password recovery, like “What city was your high school in?” are ridiculously easy to look up. My first pet’s name was lg0pDMSMkJmCHM6K. ---
**Author:** ![SenorBeef](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senorbeef/32/2220_2.png) [@SenorBeef](https://boards.straightdope.com/u/SenorBeef)\ **Post date:** [August 28, 2014, 10:54am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/33 "2014-08-28T10:54:17Z")
> [@Chronos](#): > > To be clear, I did not mean to suggest that an attacker would receive feedback on a partial-match password. What I meant is that any attack vector which will try “thisisreallyquitealong” will also try “thisisreallyquitealongpassword”. Not necesarily. I doubt there are procedurally generated dictionary attacks which map out trillions of 4-10 word sentences. Perhaps there are lists of millions or billions of common phrases, but I’m not even sure that would be among them. Certainly you would increase the security of such a password by simply changing it to thisisreally%quitealongpassword - but a 30+ character sentence falling victim to a dictionary attack seems unlikely. If you have access to the hash files - the way the passwords are stored - you can use some GPUs to run millions of hashes per second against the content of that file and end up with some matches by literally trying every possible permutation of a certain number of characters. Every time you add a character to the password length, you increase the possible permutations by however many different characters you can use in your password. Simplistically, if you could use only 0-9 and lowercase letters, a 3 digit password only has 46656 possible permutations, which is rather trivial to crack. But a 30 digit password with the same 36 characters would have roughly 1.5e+53 permutations. Using such brute force methods, My$C@t3 is a relatively insecure password, but “buttfrogsfrankenstein” is very secure. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 28, 2014, 3:21pm UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/34 "2014-08-28T15:21:46Z")
> [@](#): > > Every time you add a character to the password length, you increase the possible permutations by however many different characters you can use in your password. This is true only if every possible added character is equally likely. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [August 29, 2014, 1:35am UTC](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540/35 "2014-08-29T01:35:53Z")
> [@tellyworth](#): > > The person trying to guess your password doesn’t know which character(s) are digits and which are letters. If they know the site’s policy requires at least one number, then then have to guess a-z and 0-9 at each and every position in your password. So, 36^n possibilities with letters and numbers, compared with 26^n for letters only, where n is your password length. More still if it’s case sensitive and includes other characters. Actually it is 62^n vs 52^n considering most passwords accept capital and lowercase letters. [Previous page](https://boards.straightdope.com/t/why-are-alphabetic-passwords-weaker/696540.md?page=1)