So, the Headmaster's office at Hogwarts is guarded by Gargoyles. At one point in the books (I think that it was in the 4th book, but I'm not positive), Harry Potter wants to see Dumbledore and guesses the password after numerous unsuccessful attempts. The Gargoyles dutifully let him in.

Why were the Gargoyles that dumb? With a "normal" password system, you'd be "locked out" after a certain number of unsuccessful attempts.

  • 2
    'With a "normal" password system, you'd be "locked out" after a certain number of unsuccessful attempts.' Not at all true. And it certainly wasn't true or commonplace at the time the story takes place. Dictionary attacks etc. took longer but they weren't exactly thwarted by locking out after some attempts (it also has potential flaws and esp denying service to the real user). You'd be surprised how often this isn't deployed. Of course security is a many layered thing, always, and the fact Dumbledore's office doesn't have that says numerous things too. – Pryftan Oct 19 '17 at 21:29

Ordinarily, the gargoyle wouldn't be overcome by a random password.

You seem to be thinking of computers when you talk about being shut out after a certain number of incorrect attempts. This isn't how passwords work in the non-digital world. How difficult it is to gain entry after an incorrect password is down to the strictness of the guard, not some arbitrary prearranged number. In some contexts getting the password wrong once would be enough to merit execution. In others the entree could be left to guess for hours if they wished (or the basis that it's their own time their wasting).

The stone gargoyle outside the headmaster's office was on the more relaxed side. This wasn't "dumb" of it. We have no reason to think that people were randomly guessing the password all the time and gaining access. I'd that had been the case then the system would have been reevaluated fairly quickly. Instead, Harry is the only person who gets in on a lucky guess - and, crucially, that's because he had a head start by knowing a previous password.

When he goes to see Dumbledore in his second year he hears McGonagall saying that the password is sherbet lemon. Consequently, in his fourth year, he is able to correctly guess that the password is cockroach cluster by assuming that Dumbledore is opting for a confectionary-based theme.

Harry had walked right past the stone gargoyle guarding the entrance to Dumbledore's office without noticing. He blinked, looked around, realised what he'd done and retraced his steps, stopping in front of it. Then he remembered that he didn't know the password.
"Sherbert lemon?" he tried tentatively.
The gargoyle did not move.
"OK," said Harry, staring at it. "Pear drop. Er - liquorice wand. Fizzing Whizzbee. Drooble's Best Blowing Him. Bertie Bott's Every Flavour Beans...oh no, he doesn't like them, does he?...Oh, just open, can't you?" he said angrily. "I really want to see him, it's urgent!"
The gargoyle remained immovable.
Harry kicked it, achieving nothing but an excruciating pain in his big toe.
"Chocolate Frog!" he yelled angrily, standing on one leg. "Sugar quill! Cockroach cluster!"
The gargoyle sprang to life, and jumped aside. Harry blinked.
"Cockroach cluster?" he said, amazed. "I was only joking..."
(Goblet of Fire, Chapter 29, The Dream).

It's pretty evident that, even though Harry was guessing wildly, he wouldn't have got in if he hadn't have known that there was a sweets-based genre. If he hadn't have known the first password and hadn't guessed that the new password might be related to the first then he wouldn't have got in. Most students wouldn't have been in a position to know former passwords so would be relegated to pure guesswork. Needless to say, it's a million to one that they should stumble across cockroach cluster.

So the gargoyle's strategy was sound. Harry just got lucky.

  • 5
    This, of course assumes that Dumbledore's office has strict security. It doesn't. The lock appears to be to prevent casual intrusion – Valorum Oct 19 '17 at 18:50
  • @Valorum True. And any security system that has only one layer is woefully inadequate. That's one of the real problems with passwords: that's all there is (of course it's also that people reuse passwords, don't know how to make a good password, write them down, and so on). In the end though it's not true to suggest that 'normal' password systems will lock out after X attempts (many do not); and it was much less common back in the 1990s. – Pryftan Oct 19 '17 at 21:32
  • @TheDarkLord ' This isn't how passwords work in the non-digital world.' It's often not with computers too (and to think that this type of mechanism is all that sufficient or useful is naïvety to the extreme; it has the effect of locking out the real user and also won't deter a dedicated attacker anyway - if they even care about passwords at all and haven't determined it before the attack if they do need a password); and it was much less common back then. Security was extremely lacklustre in the 1990s compared to now (and yes that's saying a lot indeed). – Pryftan Oct 19 '17 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.