ä ist traurig, weil ä zählt als Sonderzeichen und doch irgendwie nicht. Schluss mit Sonderzeichen zweiter Klasse!
Was hat das mit dem hash zu tuen? Dachte es geht darum die entropie des PWs zu erhöhehn?
Die Entropie erhöhst du mit Länge, denn ein Zeichen ist ein Zeichen. Nur bei Wörterbuch Angriffen sind Zeichenklassen interessant.
Wait, are you saying astyfkiz is a better password than dA%6f}y just because it is longer?
Basically if B is the number of possible symbols and n the length of your password then the number of possible passwords is B^n
This number grows faster for increasing n than for increasing B. So even passwords on only two symbols will be more secure than passwords containing any possible unicode symbol - as long as they are long enough.
In the case where an attacker doesn’t even know whether you are using fewer possible symbols or not the number n is even more important. Also if people are forced to use certain characters they tend to use shorter passwords just to be able to memorize them. However if an attacker correctly assumes that you are only using lower case letters he will still have an easier time guessing your pwd just because you followed a strategy.
Humans are generally bad at thinking about randomness. Most would assume that AAAAAA is a less random phrase than €jK6%g but they are equally likely and therefore equally safe - if your enemy isn’t also a human / knows that you are one and tries AAAAAA first before testing random phrases.
