If I use a system that allows all Unicode characters or a similarly large space

Question

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ? ,which I found under Mandaic and doesn't render properly in Firefox for me)? I understand that in theory, an attacker making a brute force attempt would probably determine the character space and use the entirety of the possible characters. But, is this common in password cracking software? Is it likely that someone would try bruteforcing a large character space, or more likely they go for the low hanging fruit of alphanumeric and maybe include special characters easily entered on a keyboard?

I understand that Security Through Obscurity Is Bad and relying on this as the sole method of choosing a password is a bad idea and I shouldn't choose a 1 character password with the assumption that no one would try my character. But I'm curious if anyone has information about how strong of a password something like "????????" would be based on how hackers actually work.

Explanation / Answer

Technically, characters are just sequences of bytes. So while that character may look incredibly exotic to you, there's nothing special about it. It may occupy a few more bytes than, say, an ASCII character (depending on the encoding), but that's it.

Of course an attacker will probably start with the low-hanging fruit (words from a dictionary, digits-only, alphanumerics etc.). But after this, they may very well switch to raw bytes, and then the only thing which protects you is the actual entropy of your password. Where the bytes come from is irrelevant. Instead of your exotic Unicode characters, you might as well use an equal amount of ASCII chars.

Another problem with Unicode is that it's not fully supported by all applications. Some don't support it at all, others only support the BMP. That means there's a certain risk that your password will be mangled in some way -- if they're even accepted.

So to answer your question: Yes, there is a benefit if you assume that the attacker will only go after

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.