0

My very first question and I am happy to see that the algorithm did not come close enough.

My question is about the strength of a particular string to be used as a password. Is the length and mix of characters (upper and lower case letters, numbers, and other special characters) the only measures of the strength of the password that we have to work with?

Is there anything else that we can add to the mix to make strong passwords? What I am thinking about is control characters like the when we used to send a form feed to a printer back in the days. Could we use these kind of key combinations to add to passwords?

Thanks for any help.

Waseem

W. Nassif
  • 1
  • 1
  • Thank You John for an insightful reply. But I am not sure why my very first question was marked as a duplicate, I did compose this question and the system did not tell me that it was asked before, otherwise I would have read the discussion and joined in. Sorry if I goofed. I will learn as I as I live. – W. Nassif Sep 08 '16 at 19:18

1 Answers1

0

Theoretically, the strength of a password is the number of tests it would take to guess it. In pure mathematical terms, it's the number of possible characters in the character set raised to the power of the length of the password. But the real measure of strength of a password is "how long will it withstand an attacker?"

We all know that most user-selected passwords don't take advantage of the full character set, because complex passwords contain too much entropy for a human to easily remember. So, most passwords consist of natural language words with slight modifications; vastly reducing the number of passwords that an attacker has to test. In other words, adding the ability to hit the control key won't make any users actually hit it, meaning it won't add much to the effective strength.

John Deters
  • 33,650
  • 3
  • 57
  • 110
  • John, appreciate for the efforts for this answer. However, as techraf mentioned it is duplicate, do you think it will be better to shift the answer to this question : http://security.stackexchange.com/questions/4630/how-can-we-accurately-measure-a-password-entropy-range?noredirect=1&lq=1 – one Sep 06 '16 at 06:08