Re:GoToMyPC has been hacked, all customer passwords reset
by zo1 on Sunday June 19, 2016 @04:59PM
(#11934651)
>"The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)"
You're absolutely right, not sure why I got ahead of myself with using factorial so incorrectly.
Re:GoToMyPC has been hacked, all customer passwords reset
by umanwizard on Sunday June 19, 2016 @05:59PM
(#11934903)
You were probably thinking about the fact that picking, in order, 5 elements taken from a set of 1000 elements yields (1000 factorial) / (995 factorial) possible combinations.
> For a normal 5 letter (alpha-numeric only) password: > 36
With the "normal" recommendation of numbers, uppercase and lowercase letters, and punctuation, it's up around 100.
> factorial
The calculation is X^Y, where X is the number of possibilities per element, and Y is the number of elements (letters or words in these examples). So using only only lowercase letters (26) in an 8 character password would be 26^8. It's not factorial because you can reuse characters (e.g., your password could be X92m-sXp/)
> the amount of possible words is much smaller than that. But the attacker can't know that for sure
They will search the more likely words first. I read someplace that 10,000 words covers most people's vocabulary. That's still 100 times better than numbers + uppercase + lowercase + punctuation.