Re:Salted Password Hashing – Doing it Right
by yeukhon on Sunday February 23, 2014 @09:39AM
(#7285997)
I think a good password would be something like, instead of writing the letter "a" in ascii, you use "a" in another encoding (I forgot what that called). I supposed no one ever thought of cracking such password yet.
The worst I have seen is from USCIS. See this image: http://i.imgur.com/hvyziAx.png
> I supposed no one ever thought of cracking such password yet.
Good luck with that!
I wonder where the no $ comes from.
Re:Salted Password Hashing – Doing it Right
by M2Ys4U on Sunday February 23, 2014 @09:24AM
(#7285959)
>I think people started doing this when passwords were typically short, to increase the search space.
What annoys me most is when systems have a maximum password length which is something on the order of 10-12 characters. It's needlessly reducing the search space.
Re:Salted Password Hashing – Doing it Right
by mistercow on Sunday February 23, 2014 @12:47PM
(#7286680)
Similarly, when they disallow ordinary ascii characters like punctuation and spaces.
Well, then they're harder to format when printing. :)
Re:Salted Password Hashing – Doing it Right
by nitrogen on Sunday February 23, 2014 @01:10PM
(#7286781)
"I wonder how much longer..."
This may help: http://xkcd.com/936/
I think people started doing this when passwords were typically short, to increase the search space. Although one unwanted side effect is that it also reduces the search space, since if you know that pattern requirement then you know not to brute force anything that doesn't have two letters, two digits etc.
But assuming a required pattern of a certain length does the job (whatever the system administrators think "the job" is), I wonder how much longer a password needs to be, with no pattern requirement, and be as difficult or more to crack than the shorter patterned password.