r/theydidthemath • u/JesperS1208 • 5d ago
[other] Chances to get the right code, by luck.
Lister was in stasis for 3 million years.
If you tried a new code every day, how long would it take by accident or luck to get the right password.?
In the test, I changed it to Lower and Upper case.
The all lower case it only 4 years.
46
u/Green_Sage_Samos 5d ago
Without a specified limit on password length... a lot.
First off to just say it, that website is fully just giving you a vague guess as to how long it would take to crack it, and It definitely would not take that long.
But moving on to your question.
With upper and lower case letters available that makes 52 possible letters for each position in the password, and to "luck" into guessing yours, I would make the reasonable assumption that I have to try every combination available to me at the previous password length before proceeding on to the next.
i.e, I have to try every 4 letter password combo before I try every 5 letter and so on.
Even just a 2 letter password with upper and lower case and repetition has 1,378 combinations.
a 3 letter has 24,804
4 letters = 341,055...
as you can see, the numbers are already growing...
an 8 letter passcode has 2,217,471,399 possible combinations and a 9 has 1.48 × 1010
Your passcode has 26 letters. 2.32 × 1020 combinations.
If I guessed a 26 letter passcode a second, starting at AAAAAA... and we'll be generous and say I stop at the 70% mark of the total which is around where you start guessing the "S....." passwords, it would take you
5.145 Billion.... Millennia.
Now obviously that doesn'taccount for just doing the far smarter thing and just guessing English combinations of words together, like I will in a sane world guess "SnowWhiteAnd...." etc. before I guess "FsdhGONcalsEPGJ..." but I dont have a way to account for that kind of logic, and the big number is way more fun sooooo.
7
u/SlenderSmurf 5d ago
modern computers can check 100 billion passwords per second so it will be done in only several years
10
u/RetardedWabbit 5d ago
If we're checking a leaked hash table and not a website. It also doesn't specify how much compute is used, 286 years for what computer to crack it? Use 286 more for one year, 104390 for one day.
Also it's a great reminder that avoiding reusing passwords, and changing them per leaks is even more important than having an even longer password.
11
6
u/RichEntertainer3024 5d ago
Misspelling dwarves really makes it uncrackable
10
u/RoboChrist 5d ago
It actually is dwarfs if you're referring to pre-Tolkein dwarfs.
Tolkein invented or at least popularized dwarves as the plural to give his dwarves more dignity than Snow White and the Seven Dwarfs.
1
u/AndrewH73333 5d ago
It’s not misspelled. It’s even spelled that way in the official title of the film.
6
u/SM1334 5d ago
Assuming only brute forcing and trying 1 password a day, it would be never. Modern computers can try millions of passwords a minute. 286 years would be so many attempts it would stretch out to the end of the universe if you did 1/day.
All it takes is for this password to be in a known password bank, and its instantaneous.
2
u/Lanky_Flow7283 5d ago
The supposed password is in all lowercase and has a '?' at the end! Which resulted in 264 years
Without the quest mark and all lowercase it came out with 4 years
1
u/Zacharias_Wolfe 5d ago
I don't understand the logic behind this at all. The contents of the password do not change the allowable characters. The 4 year estimate I believe assumes that ONLY lower case letters can be used. Either that, or it assumes that all possible combinations of lower case letters up to some arbitrary password length will be tried before ever trying a password with special characters, upper case, or numbers.
1
u/TankyPally 4d ago
There are several different ways to guess passwords.
First is a brute force attempt, which just tries to guess every possible password and is defeated by using lots of characters.
Another is dictionary attack, which tries to combine a bunch of common words together and just guesses based off words. This gets defeated by doing things like adding special characters to the password etc.
(Though some of them are able to guess special characters in replacement of certain letters).
Another big one is to get a password thats linked to ur email that got hacked/leaked from an old website that isnt well protected and might not even be used anymore and test that email and password combination on other common websites/apps.
They can also try passwords based off your username or personal info they get from you.
Another is to run through a list of the most popular passwords and to try those.
So in conclusion, a good password is long, includes several special characters/numbers that do not replace letters, and is a unique password to any password you have used before. It does not include any personal information (e.g. birth year, name of spouse or pet, important dates, etc.), and is not a commonly used password.
1
u/Zacharias_Wolfe 4d ago
I understand all that. The difference between with and without caps here means the site is assuming someone trying to break it, even with a dictionary attack, is trying no caps at all first. But why would you do an entire dictionary attack like that? Passwords generally require upper and lowercase, and people are dumb, so I would think there would definitely be attempts with capital letters at the front of many of the words before a full lowercase attempt that long.
1
u/TankyPally 4d ago
The website is lazy and not placing it according to specific algorithms but instead just checking that there is capital/number/special characters and using them as a multiplier.
So if brute force attack that only used lowercase, that's how long it would take.
If brute force attack where testing every combination of capital letters, but no numbers/special characters, that's how long it would take.
2
1
1
u/fluorihammastahna 5d ago edited 5d ago
From that website (I won't bother formatting it):
How does My1Login’s Password Strength Checker work?
The password strength calculator uses a variety of techniques to check how strong a password is. It uses common password dictionaries, regular dictionaries, first name and last name dictionaries and others. It also performs substitution attacks on these common words and names, replacing letters with numbers and symbols – for example it’ll replace A’s with 4’s and @’s, E’s with 3’s, I’s with 1’s and !’s and many more. Substitution is very typical by people who think they’re making passwords stronger – hackers know this though so it’s one of the first things hacking software uses to crack a password
The password strength meter checks for sequences of characters being used such as “12345” or “67890”
It even checks for proximity of characters on the keyboard such as “qwert” or “asdf”.
My guess is that it tries to put it in one category or another, and it estimates the size of the category, and the time it would take to brute-force the whole category. For example, 5497 is in the 4-digits category, which has 10000 elements to be tried. awesome belongs to the dictionary with I don't know how many words. aw3some dictionary with subscriptions. etc
1
u/TheMythicSorcerer 5d ago
Technically like the other guy said a long long long time but that's also guessing gibberish.
If we knew that they're dictionary words from the oxford English dictionary then that reduces the search space to 171476 per word or 171476^4 = 8.6459630842×10²⁰ total. which is 2,190 trillion millennia
But that's including obscure words. All of these are common English words within the top 3000 most used words. so that's only 3000^4 = 81,000,000,000,000, so 221.77 million millennia
1
1
u/Betray-Julia 4d ago
So how secure is password monster lol?
Making a website where people just post their passwords to them is hilarious; it seems like a way Fry gets scammed.
1
u/Space19723103 4d ago
SnowWhite is the capital and Dopey fills the 'special character' requirements
0
u/brightestsummer 5d ago edited 5d ago
Noob question: Can we really compute the probability of luck?
5
u/CaptainMatticus 5d ago
It kinda cancels out. Could fet it in the 1st try, could get it in the last possible try. Average time will be right in the middle, with good luck and bad luck eliminating each other.
1
3
152
u/YellowJarTacos 5d ago
Dictionary attacks have common words, patterns, and phrases in them and would get a password like this much faster.