Google Answers Logo
View Question
 
Q: modern operating systems ( No Answer,   3 Comments )
Question  
Subject: modern operating systems
Category: Miscellaneous
Asked by: john1972-ga
List Price: $2.00
Posted: 29 Jun 2004 08:37 PDT
Expires: 29 Jul 2004 08:37 PDT
Question ID: 367679
not having the computer acho the password is safer than having it echo
an asterick for each character typed since the latter disclose the
password lengthto anyone who can see the screen.assuming that password
consist of lower and upper caes letters and digits only,and the
password must be minimum of 6 characters and maximum of 8
characters,how much safer is not displaying anything than echoing the
asterisk?
Answer  
There is no answer at this time.

Comments  
Subject: Re: modern operating systems
From: eoyount-ga on 29 Jun 2004 11:40 PDT
 
With your parameters, a 6 character password would have (26+26+10)^6
possible values.  26 upper case letters, 26 lower case letters and 10
digits possible in each of the 6 positions.  That comes out to
56,800,235,584 possible 6 character passwords.  For 7 and 8 characters
respectively, you have 3,521,614,606,208 and 218,340,105,584,896
possible passwords.

What this says to me is that it would be safer if you had a 6
character password, as there are only 56 billion passwords to guess. 
By the time you get to 8 characters, there are over 218 trillion
passwords to guess from, and if yours is sufficiently random it should
be safe.

Basically, the longer the password, the less you need to worry about
if people know the length or not.  It would be easy to guess a one or
two character password, but by the time you get to 8, you should be
okay.
Subject: Re: modern operating systems
From: crythias-ga on 29 Jun 2004 11:40 PDT
 
Ask any *nix user. One who's never used Linux, Unix, etc, (command
line) might very well ask if the password function is broken because
nothing echoes. If you're sure nobody is looking over your shoulder,
it shouldn't matter if echoes or not. *Some* people freak when they
don't have confirmation that a button is pressed.

If there is a hardware keycatcher, all bets are off, ... 

In general, you will find that the response is more or less to make
sure that your password isn't in the dictionary, and that you change
it frequently. After that, it's up to the user not to write the
password down on the desk. Yes, it's safer to not echo per keypress,
but how much safer really depends on how visible the monitor is.
---
I am not a Google Answers Researcher
Subject: Re: modern operating systems
From: funkywizard-ga on 30 Jun 2004 00:39 PDT
 
I would say your security detriment from echoing a "star" or other
character is offset by the fact that someone may type their password
faster if they can visually see that each character they typed has
been accepted, especailly for longer passwords. I can tell if too many
or too few characters have been registered by looking at the
asterisks, and this allows me to type my password faster because I
don't have to worry as much about typing something wrong. This serves
the purpose of not allowing someone to see which keys I am typing when
I put in my password, as they might be able to if I were typing more
slowly.

Also, a bigger antisecurity effect from the asterisk is not that
people can see how many characters your password is, but rather there
are some common windows utilities that can uncloak the asterisks into
the actual characters typed, so long as the password box and the
asterisks are still visible on the screen. This only applies to
windows passwords typed into a standard gui interface password box.

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy