Schwab password policies and two factor authentication

Re:Schwab password policies and two factor authentication by akerl_ on Monday December 22, 2014 @05:01PM (#8785522)

I like round numbers, so lets say that we've got 26 lowercase, 26 uppercase, 10 numbers, and 18 symbols, for a total pool of 80 character options. For our single lame character, you're stuck with 26. All calculations are rounded off to make them a bit less insane to read.

Assuming a 10 character password, there are 1.07 × 10^19 combinations without the restriction, 3.5 × 10^18 combinations with the restriction.

If we're dealing with a 24 character password, like my password manager slings out, it's 4.7 × 10^45 vs 1.5 × 10^45.

As you can see, it definitely reduces the keyspace, but when you look at the overall impact it's rather small.

[ Parent | on HN ]

Re:Schwab password policies and two factor authentication by arenaninja on Monday December 22, 2014 @05:22PM (#8785622)

In both cases, the decrease you quote is about sqrt(10). It does taper off when you do a 24 character password (which is about the range of what I would choose), but it's still 30%; 70% of a large number is a large number. Typical users are not so technical as to use a 24 character password and therefore, in an unsalted leak, after the rainbow tables stage, it makes it 30% easier to brute-force them (going by your numbers).

[ Parent | on HN ]