Defense against attacks using dictionaries

Question

Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?

Answer 1

Attackers often don't just use dictionaries, but also rules which permute the words in dictionaries.

For instance, a rule could be to substitute certain letters for numbers, which look the same. This would turn Password into P455w0rd.

A rule, which could apply in this case, would be to remove single letters from a word. That means just permutating the password by removing one letter or deliberately misspelling it will give you better chances, but it's not guaranteed.

To specifically answer your question: Yes, it is safer to use non-sense words than to use words in a dictionary.

However, it's not as safe as you can get. An offline password manager can generate truly random passwords for you, and will store them in an encrypted manner. This means that you never have to type in your password, except the master password to unlock the password manager.

To demonstrate this, ask yourself which password you consider safer: YunSuanLin0 or [D@,7##M]enMd*)j5fxG~KQ~?r\<DdV^?

Answer 2

This might seem like a question that has an obvious answer, but is not that trivial.

Words that do not appear in dictionaries have more randomness ('entropy') and are thus harder to guess for computers.

But they're also harder to remember for humans. And that leads to password re-use. That's very bad.

If you do not use a password manager (and you should!) using a sentence of random dictionary words is usually safer than random non-words. Learn more about this here: What password should I use? (which has a very accurate and easy to understand visual explanation)

Learn more about password managers here.

Answer 3

"Safer" is a relative term. Safer than what, under which conditions?

Under purely theoretical conditions, assuming a brute-force attack of some kind, yes nonsense words are "safer" in the sense that it is highly likely the attacker will try a dictionary attack before an exhaustive search.

In real-life conditions, dictionary attacks happen under two circumstances: a) brute-forcing your way into some system and b) breaking passwords on a leaked database of password hashes.

The solution for a) is to not use broken software. If your software doesn't lock out the attacker after 10 or 100 or some other number of failed attempts, your software is broken.

For b) it is likely that the attacker will stop after breaking the usual simple passwords that many users will be using. He will likely let it run a bit more, but it would be unusual that he keeps the cracker running until he got all the passwords - he probably has several more leaked databases with easy targets that his time and resources are better spent on.

For b), having a password that's not in the dictionary and not a simple permutation (crackers do know about the usual "replace O with zero" substitutions and much more) dramatically improves your chances of not being on haveibeenpwned.com

Answer 4

As far the dictionaries are concerned, they contain a list of most commonly used passwords, and that could be nonsense phrases and words as well. For instance, x+word+123 or x+monkey are some of the most commonly used passwords along with qwerty that don’t really make sense. So, you can use nonsense passwords, but make sure that they are unpredictable and not so common. And if you are looking to add strength in your passwords, you can combine the initial 2 or 3 words of multiple phrases. Moreover, if you can add special characters in your password, you’d much safer.

Answer 5

TL;DR: The safest way to generate a password is by generally using a password manager

Someone who cracks hashes or bruteforces login attempts has several tools at hand to find possible passwords (or password hashes respectively) in question. Dictionaries or wordlists are only one of these. So to limit your defensive techniques against dictionaries only is not enough.

As others have stated, when an attacker is using tools like hashcat or John the Ripper, rules are defined to sometimes "enhance" the words that are found in wordlists. These rules can be defined with relative ease. But how do the attackers know these rules? And where do these dictionaries come from?

The second question can be answered easily: Like the infamous rockyou.txt a lot of other dictionaries are published after data breaches of major (or minor) companies.

Now you got your wordlist. Where do you get your ruleset?

Let's go back to those dictionaries. IIRC rockyou.txt has ~14 million passwords in it. Millions of user passwords in one place that give you a giant data set which passwords are used most commonly, which letters people capitalize and where they typically put numbers and special characters.

Wordlists have changed a bit over the years because we have taught people to build different passwords than "iloveyou", "password" or "baseball". But the change is slow, because a) a lot of older folks and b) people from emerging countries where password literacy is not widespread get access to digital services.

The gist is: people want to type their passwords easily and they want to remember them easily.

Easy typing is important when it comes to numbers and special characters. In theory there are around 200 special characters that you can just type with ALT+Numpad combinations. But in reality most people use one or two of these characters (depending on keyboard layout): !@#}|) (US), !"§*#= (DE).
You probably see a pattern here, because the same goes for numbers: 1209 are most commonly used afair.

So to come back to your question.
What exactly are you trying to achieve?
You do not want to generate passwords like every other user. You do not want to use a word from a dictionary. So use password manager, right? But you cannot always do that. If you log into your system you do not have access to your password manager yet.

Sometimes you have to remember a password and then you want to have a password that is easily rememberable and also very strong. My suggestion: Try something like diceware, or let a password manager generate a password for you and remember it afterwards. Use weird words and conjugate them. Use special characters that are a bit harder to type than "!". Don't just use one special character or one number.

If you think to yourself, that you thought of a clever rule, be sure, there are a million other people who do the same thing and that attackers will know about this rule as well.

Most importantly: 1. Use really long passwords. 2. Don't use passwords that are built like everybody else's. Because these are the passwords with building rules that every attacker knows. That's how to defend against a dictionary attack.

What you get out of a strong password is time. Time that is useful for changing your password after an account is compromised. The length of your password and the way you create passwords buys you that strength and that time.