Having worked in penetration testing before, one tool I used to query SQL databases represented unknown characters as an underscore (_) before the character gets brute forced.

Bonus story: I used to set the hostname for my phone as a transparent character, so it wouldn't visibly show up if someone ever did a network scan. I accidentally fooled myself with this while doing a network scan, and got frustrated why the "mystery device" wouldn't load a hostname.

Cross-posted to !bestoflemmy@lemmy.world, which is probably the closest active community we've got

Nope, don't rotate passwords. Just don't. Best case scenario, you're wasting your time; worst case, people will actually make their passwords less secure by rotating them, e.g. some people would happily change "password123" to "password1" and call it a day.

Just pick a looong password once, make sure you don't reuse it elsewhere, and you'll be fine.

This is as per the NIST latest guidelines.

If the password is changed while the Planck Cruncher is doing its thing, and it changes to something that the PC has already guessed and tested negative, the PC is screwed.

Hint: Change your password regularly.

No.

In the real world having an actual high quality lengthty password is enough to deter anyone who is trying random accounts to move on for easier targets and anything that someone has physical access to, like law enforcement who confiscated something, will have an easier time bypassing the username and password process.

Changing passwords frequently leads to easier to break passwords, especially when you follow the practice of using a different one for different systems.

I may make a writeup about this, considering a password with all possible Unicode characters instead of just the printable ASCII characters.

A password with 300 bits of entropy would take 1.288×10^(-138) seconds to crack with the Planck Cruncher :)

1024 bit. The exact number is about 3.6019×10^72 years, which is orders higher than a vigintillion.

The Planck Cruncher has refused to comment about this. ;)

A quantum computer doesn't just calculate every possibility simultaneously, it's much more limited. It "calculates more things at once" in some cases.

Generally speaking, some things that are hard for a regular computer are easy quantum computers. So if an encryption algorithm is based on the difficulty of those things (e.g. RSA is based on the difficulty of factoring a semiprime number), and the thing is easy for a quantum computer (e.g. factoring a semiprime), then you could defeat the algorithm with a quantum computer.

How do you protect yourself? You base the algorithm on something that is difficult for both a regular and quantum computer, that's what post-quantum algorithms do.

But quantum computers have one last ace up their sleeve. There is a sure-fire algorithm (Grover's algorithm) to speed up any situation where you need to find an unknown value of a known length (in this case the secret key). To keep it simple, if to find the key a traditional computer would need N steps (because there are N possible keys), a quantum computer would need just √N, which is much less. Now, this sounds massive, and it is, but if you consider that with M bits there are 2^M keys, then if you just need to check √(2^M) keys, it's like using keys of M/2 bits, so to defend against this you just need to make the key twice as long.

Lastly, as a footnote: quantum computers can be faster than regular computers, but strictly speaking, regular computers are more powerful, that is to say they can do more things. We say that traditional computers are turing-complete, which means that they can compute anything that is computable, that is not the case for quantum computers, which means that some things (even easy things) that a computer can do, cannot be done on a quantum computer. For example, there is no way to implement regular expressions in quantum computers, it's impossible. I know regex look difficult, but in computation theory they are among the easiest things a computer can do.

Edit: one quick addition to the paragraph about Grover's algorithm. If a quantum computer really just tried all the solutions at once it would be much faster than that. It would be (may my professor forgive me for saying this) "like if it guessed the bits of the key one at a time and were right on the first try", so if you had your M bits key, you would need just M steps instead of the 2^(M/2) steps of Grover's algorithm (this is like the difference speed difference between "checking if a word is palindrome" and "calculating who will win a game of chess when using a perfect strategy"). A computer that works like that... doesn't (and probably will never) exist. But in literature they are called non-deterministic Turing machines. They would be powerful like a regular computer (not more) but unreasonably faster.

Not sure if this is what you're referencing, but there's a famous quantum computer researcher named Scott Aaronson who has this at the top of his blog:

If you take nothing else from this blog: quantum computers won't solve hard problems instantly by just trying all solutions in parallel.

His blog is good, talks about a lot of quantum computing stuff at an accessible level

Why not both?

Is it relevant, or was it just a neat extra to add?

Just a neat extra. Most passwords are represented in bits of entropy in this context, and I discovered while researching that the proper unit is a shannon.

I don't think that matters, since when bruteforcimg a passphrase it's more like using whole words as the characters (or tokens) in the password. If there's 7776 possible unique words, it doesn't matter what characters are in the words at all. Just how many password combinations are used.

Side note, this is assuming words without character replacements. If you consider variations with A->@ or B->8 there ends up being significantly more possible unique "words"

I did consider this while writing this, but I decided to keep it simple. I'm not sure how quantum physics would behave when we're discussing a computer that can already calculate at Planck "speed".