Tell me more ×
Mathematics Stack Exchange is a question and answer site for people studying math at any level and professionals in related fields. It's 100% free, no registration required.
up vote 0 down vote favorite

When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password?

Here's why I think it doesn't decrease the probability of a hacker finding out your password: Two people are asked to create a password of length 4. They are both allowed to use the full set of characters on a standard keyboard; let's pretend there's 100 such characters. Thus, the probability of a hacker guessing such a password would be (1/100)^4. Person A creates the password aaaa. Person B creates the so-called "more secure" password aA$#. How does the fact that person A using "simpler" characters change the probability? The hacker has no idea who is using only "simple" characters or not, so it can't be used to increase the probability of guessing each character correctly.

share|improve this question
1  
This question might be more appropriate at security.stackexchange.com – Mike Spivey Jun 13 '11 at 4:01
2  
If hackers guessed password by using random strings, your argument would have merit; but they don't. – Arturo Magidin Jun 13 '11 at 4:06
1  
I think this should be closed – user9413 Jun 13 '11 at 4:06
1  
This question is not appropriate for this site. During a brute force password cracking attack, a very important thing is how long the process takes, and if you don't have to worry about capital letters/symbols it takes a lot less time. There is a lot of info to say about this topic, but it's all totally inappropriate for this site! – Matt Calhoun Jun 13 '11 at 4:14
2  
show 5 more comments

closed as too localized by Chandru, Zev Chonoles♦, yunone, Mike Spivey, Jonas Meyer Jun 13 '11 at 5:20

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

1 Answer

up vote 3 down vote accepted

That is because people don't work that way. When someone chooses a password, they most likely will choose a word (and use only lowercase letters to write that word). Hackers have huge dictionaries of passwords, but those are still way less huge than trying those 100^4 possibilities, for example.

By forcing people to use such characters, you force them to create a password that is more likely not to be in one of these dictionaries.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.