On Sun, Nov 15, 2009 at 11:56:18AM -0600, Alex Dean wrote:

             ............snip.............

>
> Kurt : Is that "28 trillion hours" figure you cited the estimated time  
> to try *all* 12 character passwords?  If so, I think that's not the  
> right metric.  The search for a password stops once you've found the  
> correct one, and you'd only try them all if the correct password is the 
> very last one you tried.  It'd be helpful to know something like "I'm 
> able to attempt 95% of all 12 character passwords after 28 trillion 
> hours".  If the password is truly a random string of junk, it's perfectly 
> possible (just phenomenally unlikely) that you'll guess it on the 1st 
> try.

I was just about to comment on this. You beat me to it. In all the
different material I've read, everyone is fond of saying it would
take <insert huge number here> of years to break a strong password. 
Statistically the odds of the first try being successful are not, as you
pointed out, zero and increase with each combination. Granted, it would
still take a hell of a long time but not the <insert huge number> years
people always claim.   

-- 
Bob Holtzman
Key ID: 8D549279
"If you think you're getting free lunch,
 check the price of the beer"