Re:A plastic card for easy to remember strong passwords
by agwa on Saturday January 10, 2015 @11:19PM
(#8869003)
> You are making a rather critical mistake; you are not realizing that not only are the character associations variable, but so is the "space bar code", which will be unique for each card.
I don't know what you mean by "variable" "character associations," but note that my analysis doesn't depend on the space bar code at all, except assuming that it's the first eight characters, which the site's FAQ guarantees. Otherwise my analysis completely ignores it.
> You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..
True, but there are only a handful of logical choices for any given site.
In any case, this is just haggling - the point is that attacks like this shouldn't be possible at all for something claiming to generate "very strong passwords."
The point being that, although not impossible, it is far more complicated to break the code than you describe here.
You are also assuming that everyone will use the full name of the site, e.g., AMAZON, and not simply AZ or AMZN or AMA. For example, I may use YC or YCOMB or YCOMBINATOR for this site, which would also increase the combination exponent..