Week 4 Discussion Password security and Unicode No unread r

Week 4: Discussion - Password security and Unicode No unread replies. No replies. Should users use Unicode characters in their passwords to make them harder to crack? Why might this be a good idea... why not? If you recommend that users use Unicode, please specify how they should accomplish this? If you recommend that they do not use Unicode, what method would you recommend? What method do you use for picking and storing passwords? For your follow up replies, please comment on the initial post of at least two peers. What benefits do you see in their password strategy? What risks do you see?

Solution

I\'ll explain from the start:

Unicode:

Unicode is a standard that defines encoding and representation for consistently handling text in computers, like ASCII. But unlike ASCII, Unicode was created by a consortium with the purpose of handling all text symbols of all the world’s languages and writing systems.

Complexity:

The most common and efficient way to obtain a password is through Brute Force. The guarantee that brute force will eventually find the password does have a significant implication. In other words, if we know a certain password is an 8 digit number, then doing a brute force attack with all numbers composed of 8x digits 0-4 is not guaranteed to find the password. In this case a sufficient character set would have to include digits from 0 to 9.

Similarly, to guarantee that a certain hash generated from an ASCII password is cracked, then it is necessary to execute the brute force attack using the entire ASCII character set.

The difficulty of cracking a password is measured by the entropy in the process used to generate it.

10^11 vs 10^36 is a massive difference in complexity. The latter take 10^24 longer to run than the former.

So, yes I believe if you use Unicode in passwords it\'s more difficult to crack, but only if used in conjunction with typical best practices for passwords, and by using more than one character.

Kindly provide the feedback for the answer.