Comment on I have an acquaintance that have their own "password system" that involves having a "core" set of characters, plus a few unique characters for each site; Is that system safe?

• A_norny_mousse@feddit.org ⁨4⁩ ⁨days⁩ ago

  Things a password cracker does before brute force guessing:

  1. Dictionary attacks
  2. Leaked passwords
  3. Password guessing attacks
  4. …

  source

  • nimpnin@sopuli.xyz ⁨4⁩ ⁨days⁩ ago

    If you pick 4 random words, the attacker would still need to brute force through (hundreds of?) billions of word combinations. That’s the point.

    source

    • hangonasecond@lemmy.world ⁨4⁩ ⁨days⁩ ago

      Yeah you’re correct. The person you’re replying to is treating dictionary attacks as separate from brute forcing. Dictionary attacks are great on short passwords using likely words, but as soon as you use 2 or 3 or 4 words it becomes computationally unfeasible. I would say a completely random string of the same or much less length is more secure because a dictionary attack won’t work at all, but 3-4 word passphrases are excellent for passwords that you have to manually enter ever.

      source