The answer to your questions depends on the presence of prioritizing in dictionary attacks. If meaningful strings (read: actual words or sentences) are run first, followed (if at all) by the skipped strings that consist of a systematic series of permutations of the characters involved, hits with the latter will occur later (= after a larger number of trials). Of course, the issue of language plays a role too in selecting what's meaningful (= tried first) or not (tried later).

Then you have the issue of passwords you can remember. For example, if you choose an acronymized version of a sentence, you have a quasi-random string that likely gets tested 'later' in dictionary attacks, and is still memorable. Either way, the password variation you prefer is aimed at increasing the number of trials needed for a hit, and hence increases the security of your password. But ultimately, increasing computing power will reduce the time needed for a full analytic password attack of increasingly long strings, requiring more and longer passwords, and decreasing the possibility of memorable ones, however smartly composed. But as long as Virtual1's scenario of out-of-context (non-live) attacks cannot be used, you'll have more password leeway.


alternaut moderator