The weakness lies in the password length. Most users are simply negligent when choosing their password combination. This is especially true for setting passwords for remote access. Often and for whatever reason, shallow as well as simple combinations of characters are chosen here in the form of names, dates of birth or strings of keyboard shortcuts. Users who do so, put themselves at a high security risk. Short password combinations of a four- to six-digit character length are particularly affected.
Here’s an example: For simplicity, employee A selects a four-digit password for remote desktop access that consists only of lowercase letters. Attacker X is aware that the security arrangements are only marginal in employee A’s company. For this reason, the attacker decides to check all small letter combinations of four characters length to get the password of employee A.
The resulting variants amount to 456,976, which mathematically corresponds to 26^4. Powerful hardware allows attacker X to gain the password of employee A in just a few seconds by setting the correct parameters in his brute-force software. If successful, the attacker gains full control of the system.
This example illustrates the relevance of the password length which every user should consider. The decryption time of the attacking software increases with an increased password length. The same applies to the additional use of large and small letters as well as numbers and special characters. It therefore seems advisable to use password keys that have more than 32 characters. For example, lengths of 256 and 512 bits are common. Here, the level of difficulty on the attacker’s side is significantly higher than with a shorter-length string.