Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Bugs & Viruses If you want to ensure you have adequate passwords but don't have the time or interest to study the topic, there's a useful basic article on how to devise strong passwords over at the NY Times. It summarizes key points in 9 simple rules of thumb. Also see the follow-up article for useful reader feedback. Stay safe!
Permalink for comment 542101
To read all comments associated with this story, please click here.
RE[5]: make 'm long
by Laurence on Mon 12th Nov 2012 09:08 UTC in reply to "RE[4]: make 'm long"
Member since:

You're kind of switching the bait here.

I'm really not. I might not be explaining things that well (English isn't me strongest skill), but my advice here has been consistent.

The second paragraph only provides knowledege for old style single-word passwords. A passphrase is made up of multiple words, which is much more difficult to analyse behaviour.

You're making an assumption that dictionary attacks can only work against a single instance within the dictionary file. What modern dictionary attacks actually do is use a the dictionary as a basis for a "brute force-style" attack.

Let me explain this better:
the old style brute force attack would try every character permutation (eg (if you don't mind some crude regex) m/[0-9a-zA-Z]/ and any symbols opted for).

Modern dictionary attacks use the dictionary as a bases for building the permutations. So if the dictionary file has: add, dad, bad then the attack will use add, dad, bad, addadd, adddad, addbad, dadadd, daddad, dadbad, badadd, baddad, badbad plus the "l33t" variants ("d4d") formating variants ("dad dad", "dad!") and so on.

So while it's technically still a dictionary based attack, it's significantly more sophisticated than a standard dictionary attack yet also significantly quicker to run through likely permutations than the old style brute force attack.

Assuming that the cracker somehow can distinguish a passphrase from a long password, they're just confronted with using an almost brute force attack on the word combinations.

Using a 10,000 word dictionary, a passphrase of five words is a space of 100,000,000,000,000,000,000 possibilities. The English language alone has about 250,000 words depending on the OED estimate.

Indeed. But the point is that's still massively quicker than doing every character permutation.

To put it another way, you stated that 5 word match might offer up 10^19 combinations (which I think is an over-estimate, but I'm still willing to use those figures), using a standard brute force attack offers up (10+26+26+20)^16 combinations (10 numeric characters, 26 alpha in both cases and 20 symbols) for a 16 character sequence. That works out at 2044140858654976 possible solutions and that's not even the entire length of an average 5 word string (which is what you're basing your example on).

So an intelligent dictionary attack really is the better cracking routing and why you have to assume that attackers are using it.

Reply Parent Score: 2