Is repeating text in a password considered weak?

Brute force is really a bad way to judge the strength of passwords. The way passwords are most commonly cracked is using a dictionary attack, along with some patterns. While it is still brute forcing the password, it is isn't trying anything near the usual 62^n or so attempts your brute force calculation is based off of.

Dictionary attacks have two main components:

1. The dictionary. The size and quality of the dictionary are highly important. If your dictionary is 12 words long it is going to be phenomenally fast, but it probably won't be very effective. On the other hand, if you just save the 62^n -ish brute force attempts as a dictionary, you aren't going to do very well either. A good dictionary typically has a full dictionary of words (or at least the most common ones), common letter combinations (e.g. aa, aaa, aaaa), names, profanity, slang, etc. It covers all of the bases but is still going to be small relative to a brute force attempt.
2. The pattern(s) to match. A dictionary attack often uses patterns in an attempt to get common passwords. For example, a very common pattern would be word digit digit where the pattern would attempt every word in the dictionary with 2 digits. This gives us 100 * number of words attempts, which isn't too bad, and this often gives very good results. Another common pattern is to capitalize the first and last 1 or 2 letters of the word, maybe combine it with this pattern. Using this method and a good dictionary, we can find most people's passwords.

Keep in mind this is just one method of password cracking, there are other methods and ways to do things, but this is straightforward and is probably the best method to illustrate the difficulty of having a good password.

So, for your original question: is aaaAAA!1aaaa a good password? I mean, now that you posted it here, probably not. But This would be a pretty good password in terms of brute force and dictionary attacks. You may even want to alter some of the letters, for example aaaAAE!1aaeaa would be a bit stronger of a password, and still plenty memorable.

Solved by user5391191 (847 )
Oct 30, 2016 at 00:55