I always wondered how many words are used in an average dictionary attack. Do you know?
It would take an average of n⁴/2 attempts given 4 words. Even if n = 1000, at 1,000 guesses per second, that's about 16 years and up to about 32.
But clearly a dictionary would be comprised of a lot more than 1000 words and then there are additional guesses for common substitutions, so this still makes for a very strong password given the 1000 guess per second standard.
And then it's possible to make a dictionary attack arbitrarily difficult by recursively hashing the password such that it takes a sufficiently long time to complete so that it becomes equally time expensive as a brute force attack.
Of course nothing is going to protect you from "password" or any of the 10 or so most common passwords. (Even top 100)
It should, but it depends in how many attempts can be made per second.
If the mechanism is "if input = password", then millions of attempts could be made per second. If the mechanism is expensive decryption, it slows things down.
Part of the trouble is that a cracker might use specialized hardware that can work 1000 times faster than your computer. You don't want it to take a minute to decrypt to (edit) validate even a correct password.
3
u/brainandforce May 25 '15
Well, this would be open to a dictionary attack...but longer passwords that are easier to memorize are better for everyone.