Doing Password Complexity Wrong
Posted: Tue, 8 July 2014 | permalink | 2 Comments
I just made an account on yet another web service. On the suggestion of my
password manager, I attempted to use the password “W:9[$X*F”. It was
rejected because “Password must contain at least one non-alphabet character,
one lowercase letter, one uppercase letter”. OK, how about “Passw0rd”?
Yep, that’s fine.
Anyone want to guess which of those two passwords is going to fall victim to a brute-force attack first? Go on, don’t be shy, take a wild shot in the dark!
2 Comments
From: Paul Mellors
2014-07-08 16:48
Well being the expert user I am, I would say the problem lies with “W:9[$X*F”, I mean take W, it’s the second letter on the keyboard, how easy is that to get ;)
From: Matt Palmer
2014-07-08 16:55
Wow, I never thought of it that way. That’s probably exactly the problem. (grin)
Post a comment
All comments are held for moderation; markdown formatting accepted.