A password's guessing time depends on the attack
Password-guessing time depends on how a password was chosen, the number of guesses possible, and whether the attack targets a live login screen or a stolen database. Counting possible characters leaves out important parts of that comparison.
Questions you could explore
- Why does counting possible characters miss the way people choose passwords?
- How do rate limits and password hashing change an attack compared with trying guesses on an unrestricted system?
Start reading
- National Institute of Standards and TechnologyNIST SP 800-63B: Authentication and Authenticator Management
Explains predictable password choices and the difference between rate-limited online guesses and offline attacks.
Ready to try your ideas aloud?
Your topic carries over. Record up to 2½ minutes, depending on your plan.