Random guessing would be a poor way to do an off-line attack, because after making #(dictionary size) guesses, you still only have a 50% chance of having guessed the correct password. However, it *would* be a good way to do on-line attacks, or offline attacks where the attacker can detect password changes, where there is a high probability of the password changing during the attack, because that way, the password change has no effect on the attack whatsoever.
A random walk through the dictionary space, rather than random guessing, would be a good way to do an off-line attack, since the victim counldn't react to the attack's progress, assuming that it was known. |
