Re:Cracking WPA-2 Just Got a Whole Lot Easier
by Dylan16807 on Tuesday August 07, 2018 @02:12PM
(#17709055)
> But, a lot of people do use reduced character sets, so I'd expect brute force attackers to give some preference for searching those first--but how much?
The correct answer is that it barely matters.
So an Alice password is worth 27.6 digits and if you went in order of entropy you'd try them after you try 27 digit passwords.
Let's say you think it's overwhelmingly likely that a password is Alice-style, maybe 99% likely. This suggests that you devote 1% of your processing power to Bob style. Instead of trying Alice-style passwords after you try 27 digit passwords, you will try them after... 25 digit passwords
Because the difficulty increases exponentially, devoting just a smidge of processing power to each different kind means that your progress goes roughly in order of increasing entropy.
And Bob's password will be cracked first, since "digits" is a very reasonable category to devote some computation to.
The correct answer is that it barely matters.
So an Alice password is worth 27.6 digits and if you went in order of entropy you'd try them after you try 27 digit passwords.
Let's say you think it's overwhelmingly likely that a password is Alice-style, maybe 99% likely. This suggests that you devote 1% of your processing power to Bob style. Instead of trying Alice-style passwords after you try 27 digit passwords, you will try them after... 25 digit passwords
Because the difficulty increases exponentially, devoting just a smidge of processing power to each different kind means that your progress goes roughly in order of increasing entropy.
And Bob's password will be cracked first, since "digits" is a very reasonable category to devote some computation to.