For me it’s the paranoia surrounding webcams. People outright refuse to own one and I understand, until they go on and on about how they’re being spied. Here’s the secret - unplug the damn thing when you think you won’t use it or haven’t used it in a while.

They, whoever it is, can’t really spy on you on something that’s already off and unplugged!

  • Don_alForno@feddit.org
    link
    fedilink
    Deutsch
    arrow-up
    2
    ·
    edit-2
    2 months ago

    By adding uppercase letters (for a total of 52 characters to choose from), you get 52 * 52 = 2704 possible passwords.

    You don’t add them, you enforce at least one. That eliminates all combinations without upper case letters.

    So, without this rule you would indeed have the 52x52 possible passwords, but with it you have (52x52)-(26x26) possible passwords (the second bracket is all combinations of 2 lowercase letters), which is obviously less.

    The only way you would decrease the number of possible passwords is if you specified that the character in a particular spot had to be uppercase

    Wrong. In your example, for any given try, if you have put a lowercase letter in spot 1, you don’t need to try any lowercase in spot 2.

    Any information you give the attacker eliminates possible combinations.

    • cmfhsu@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      2 months ago

      I think I’m confused on your point.

      I interpreted your statement to mean “adding a requirement for certain types of characters will decrease the number of possible passwords compared to no requirements at all”, which is false. Even in your example above, with only two letters, no numbers / special characters allowed, requiring a capital letter decreases the possibilities back to the original 676 possible passwords - not less.

      Perhaps you’re trying to say that passwords should all require certain complexity, but without broadcasting the password requirements publicly? I suppose that’s a valid point, but I don’t think the tradeoff of time required to make that secure is worth the literal .000001% (I think I did the math right) improvement in security.

      • Don_alForno@feddit.org
        link
        fedilink
        Deutsch
        arrow-up
        3
        ·
        2 months ago

        Even in your example above, with only two letters, no numbers / special characters allowed, requiring a capital letter decreases the possibilities back to the original 676 possible passwords - not less.

        No it doesn’t. It reduces the possibilities to less than the 52x52 possibilities that would exist if you allowed all possible combinations of upper and lower case letters.

        You are confused because you only see the two options of enforcing or not allowing certain characters. All characters need to be allowed but none should be enforced. That maximizes the number of possible combinations.

        that passwords should all require certain complexity, but without broadcasting the password requirements publicly?

        No, because that’s still the same. An attacker can find out the rules by creating accounts and testing.