News for hackers. Stuff that matters.

A comment on The password “ji32k7au4a83” has been seen over a hundred times. Parent comment

Re:The password “ji32k7au4a83” has been seen over a hundred ... by Dylan16807 on Saturday March 09, 2019 @05:23PM (#19348895)
"a function of the size of your character pool, because if your password is short enough for n-1 to contain a significant percentage of possible combinations then it's probably already short enough to brute force anyway"

This seems to say that a small character pool, aka "n-1 containing a significant percentage of possible combinations", implies that your password is "probably already short enough to brute force".

So small character pool means that "probably" the password is short/weak.

I'm saying that a small character pool does not imply that a password is "probably" short/weak.

And to be very clear: Using the size of the character pool to say it's "probably" weak is a form of "reliably predict[ing] if n is sufficient".

What am I misreading?

[ Parent | on HN ]
Re:The password “ji32k7au4a83” has been seen over a hundred ... by kakarot on Sunday March 10, 2019 @03:44PM (#19353947)
> What am I misreading?

> So small character pool means that "probably" the password is short/weak.

I really don't know how you came to that conclusion. I never claimed any dependence between the character pool length and password length. They're obviously completely separate properties.

[ Parent | on HN ]
Re:The password “ji32k7au4a83” has been seen over a hundred ... by Dylan16807 on Sunday March 10, 2019 @11:12PM (#19356377)
You said that if a password of length n-1 "contains a significant percentage of combinations" compared to a password with length n then "it's probably already short enough to brute force".

Right?

That percentage comes entirely from the character pool.

So character pool -> percentage -> probably short enough to brute force.

What am I reading wrong? The only assumption I made is "compared to a password with length n", because what else would you be comparing length "n-1" to. Otherwise it's a direct quote.

[ Parent | on HN ]