|
|
Log in / Subscribe / Register

Password length

Password length

Posted May 16, 2013 12:56 UTC (Thu) by robbe (guest, #16131)
In reply to: Fedora's invisible passwords and visible squabbles by Baylink
Parent article: Fedora's invisible passwords and visible squabbles

> Those who note that asterisks are bad are also correct; knowing the length
> of the password substantially reduces the effort to crack it.

Depends on your definition of "substantial". For the cases I computed, and that I consider relevant, the effort reduction is not even half. Not what I would call a good safety margin.

The more important advantage an attacker gains by seeing the (approximate) password length is being able to weed out "too hard" passwords, and just attack accounts with easier ones.

to post comments

Password length

Posted May 16, 2013 14:20 UTC (Thu) by robbe (guest, #16131) [Link]

Oops, I miscalculated. The added effort for the attacker if she does not know the password length asymptotically approaches (b+1)/b, where b is the size of the character space. Worst case for the attacker is a numeric password, which adds only a measly 11 % of effort. Lower-alpha gives 4 % more, etc.

Password length

Posted May 16, 2013 14:46 UTC (Thu) by anselm (subscriber, #2796) [Link]

Way back when, VAX/VMS used to output either one asterisk or three for every password key pressed, on a random basis. This had the advantage of letting the user know that their keypress had registered, without giving bystanders a good clue how long the password in question actually was.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds