Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Surprising considering that the latter has less than 2 bits more entropy.


By my math, a 10 byte sequence of decimal numbers has 33.2 bits of entropy, while a 8 byte sequence of lower case numerals and decimals has 41.3 bits. That's almost 300x as hard to crack.

There's also the issue of pattern heuristics. Number-only passwords seem like they'd be common, and thus a reasonable pattern to try out to ~35 bits or so (something that corresponds roughtly to "can be tried in a perceptively short time"), but it's not as clear that there's a significant fraction of passwords in the wild that use alphanumerics but no capitals. So they wouldn't try the passwords from the 36-character alphabet, more likely using a slower heuristic like things where the leading alpha character might be capital, or there might be punctuation between "words", etc...


All-number passwords are default on several ISPs so they're much more likely to succeed than a full keyspace search.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: