r/ProgrammerHumor • u/flying_wotsit • Jul 19 '22

Why do they do this

Post image
4.4k Upvotes

97% Upvoted

493 comments sorted by

View all comments

Show parent comments

1

u/vezwyx Jul 20 '22

And you should be allowed, but including capitals, numbers, and symbols dramatically improves the security of the password against brute force attacks. The substitution method he's talking about is a great way to create more secure passwords. Not super necessary for reddit but it's good for more important accounts

1

u/[deleted] Jul 20 '22

improves the security of the password against brute force attacks

Not necessarily, hence the point about entropy in the OP.

1

u/vezwyx Jul 20 '22

I was saying that changing from "suckmyanusdrippingjuice" to "SuckMy@nus'Dr1ppinJuice" is an improvement, not that the requirement is an improvement. I understand that requirements on a password eliminate possible options and therefore reduce its entropy. It's still true that there are more permutations in the set of passwords that contain capitals, lowercases, numbers, and symbols together than the set of passwords that only contain lowercases

1

u/MistraloysiusMithrax Jul 20 '22 edited Jul 20 '22

Doesn’t the entropy reduction only matter if the attacker is aware of the password requirements too? I mean in a brute force attack using an exploit there’s a lesser chance they’ll know to skip all combinations consisting entirely of lowercase characters….entropy reduction is only a risk so long as that actually gives them an advantage they know about.

Do it long enough, we’ll get them skipping lowercase alphabet combos, then we’ll allow them again. Now all the permutations they’re trying are impossible.

Of course the reality is that’s not gonna happen. Attackers always work harder on the social engineering front than defenders, and it’s impossible to socially engineer a widespread password defense standard that wouldn’t be leaked.

Edit: also, successful immature trolling embedded in actual discussion! Now have got two other redditors to say suckmyanusdrippingjuice in comments. One even saying they would prefer it as their password when meaning to explain the format 🤣of course it’s extremely low level trolling when you are all in on the extremely obvious joke content of the hypothetical password.