Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Bugs & Viruses If you want to ensure you have adequate passwords but don't have the time or interest to study the topic, there's a useful basic article on how to devise strong passwords over at the NY Times. It summarizes key points in 9 simple rules of thumb. Also see the follow-up article for useful reader feedback. Stay safe!
Thread beginning with comment 541955
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: make 'm long
by Laurence on Sun 11th Nov 2012 11:32 UTC in reply to "make 'm long"
Laurence
Member since:
2007-03-26

Pick a couple of words, at least one of them in your local dialect (to avoid dictionary attacks) and stick them together with numbers like this:

Coca300ColaInEmpireStrikesBack (imagine Luke drinking 300 cans of Coke)

Or make a phrase that you can easily remember:

IWant14XtraVacationDaysAfterEaster
YesINEED3cupsofcoffeeEVERYsingleday

..don't forget to insert at least one word in your local dialect.

Os use http://xkcd.com/936/

Unfortunately all of those things are easily crackable by current attack algorithms.


Common misconceptions with password security:

* concatenating words together is more secure == false. Modern attacks use a dictionary of words and tries combinations of such words concatenated.

* using txt spk / l33t style words are harder to crack than common words == false. Modern dictionaries have every imaginable combination of number and non-alpha/numeric substitutions of letters as well as plain English words.

* using non-English words are more secure == false. Dictionaries include words from most languages, proper-nouns and even slang that isn't technically part of any language.


Password cracking has come a long way in the last few years and current security advice hasn't kept up with development. In my opinion there's only 3 things you can do to have a truly secure password:

1/ use a password hash. This will be a mixture of alpha, numerics and symbols. Generate this hash from any site like this: http://www.insidepro.com/hashes.php?lang=eng and have the website / application name as the salt and the same password as the password. This way you get a unique, non-guessable password for each service and an easy way for you to "keep" your passwords without having to write them down nor store them in any digital keychains.

2/ use a unique password for each service. I'd already mentioned that above, but it's so important it needs repeating.

3/ at all times possible, use key based systems (eg SSH keys instead of login passwords). Even just 2048bit RSA keys are significantly more difficult to crack than 99% of passwords. Sadly though, key based systems are rarely available for most systems.



Password security isn't difficult, however there's a lot of outdated advice that people still hold tight to.

Edited 2012-11-11 11:36 UTC

Reply Parent Score: 2

RE[2]: make 'm long
by kwan_e on Sun 11th Nov 2012 14:34 in reply to "RE: make 'm long"
kwan_e Member since:
2007-02-18

I'm ignorant on these matters, but I don't see how passphrases could feasibly be cracked using dictionary based attacks.

The number of possible words and alternate "spellings" is large, especially if you consider multiple languages as you've mentioned.

You also mentioned "without writing it down", but I was under the impression that was also out of date ideas about password protection. The chances of someone physically getting your password is practically zero, since most people won't risk it, most people aren't that important, and those who do risk stealing things generally aren't after written down passwords (assuming they know the username the person uses).

Edited 2012-11-11 14:44 UTC

Reply Parent Score: 2

RE[3]: make 'm long
by Laurence on Sun 11th Nov 2012 20:59 in reply to "RE[2]: make 'm long"
Laurence Member since:
2007-03-26

I'm ignorant on these matters, but I don't see how passphrases could feasibly be cracked using dictionary based attacks.

The number of possible words and alternate "spellings" is large, especially if you consider multiple languages as you've mentioned.

While you're right that such attacks would require massive dictionary of words - it's still significantly more streamlined than a typical 'brute force attack' which will try every character combination individually.


You also mentioned "without writing it down", but I was under the impression that was also out of date ideas about password protection. The chances of someone physically getting your password is practically zero, since most people won't risk it, most people aren't that important, and those who do risk stealing things generally aren't after written down passwords (assuming they know the username the person uses).

You're talking about 'security through obscurity' and that's a pretty bad philosophy to have.

There's been cases where 'normal' individuals like ourselves have become over-night public figures because of stories that break out in the press (eg relatives of crime suspects) and have subsequently been stalked over social media by reporters after a cheap story.

There's also cases about answer phone hacking that broke out earlier this year and many of those cases were against regular people.

And finally, regular people do get their accounts hacked all the time (eg my Paypal account was hacked a few years ago)

So don't think that your relative obscurity will protect you.

Edited 2012-11-11 21:00 UTC

Reply Parent Score: 2

RE[2]: make 'm long
by Fergy on Sun 11th Nov 2012 17:26 in reply to "RE: make 'm long"
Fergy Member since:
2006-04-10

Common misconceptions with password security:

* concatenating words together is more secure == false. Modern attacks use a dictionary of words and tries combinations of such words concatenated.

* using txt spk / l33t style words are harder to crack than common words == false. Modern dictionaries have every imaginable combination of number and non-alpha/numeric substitutions of letters as well as plain English words.

* using non-English words are more secure == false. Dictionaries include words from most languages, proper-nouns and even slang that isn't technically part of any language.


Password cracking has come a long way in the last few years and current security advice hasn't kept up with development.

Use lower case: 26 possibilities
Use upper case: 26 possibilities
Use numbers: 10 possibilities
Use punctuation: 32 possibilites
Use them all: 94 possibilities per character

Using English is the easiest way to fall victim to dictionary attacks. Put in another language and suddenly the cracker would have to include 20+ dictionaries. Put in a dialect and the cracker would need to put 2000+ dictionaries in.

How can you possibly claim that increasing the possibilities is _not_ more secure?

Reply Parent Score: 2

RE[3]: make 'm long
by Laurence on Sun 11th Nov 2012 20:49 in reply to "RE[2]: make 'm long"
Laurence Member since:
2007-03-26


Use lower case: 26 possibilities
Use upper case: 26 possibilities
Use numbers: 10 possibilities
Use punctuation: 32 possibilites
Use them all: 94 possibilities per character

Using English is the easiest way to fall victim to dictionary attacks. Put in another language and suddenly the cracker would have to include 20+ dictionaries. Put in a dialect and the cracker would need to put 2000+ dictionaries in.

How can you possibly claim that increasing the possibilities is _not_ more secure?

You're missing my point. Modern attacks aren't the old style brute force attacks which would try every combination of character. Instead they have every more sophisticated dictionaries (I'm not sure if those are hardcoded possibilities or heuristics).

The problem is we've had an influx of leaked passwords over recent years. Nearly every month another website gets hacked and passwords are leaked - and this provides a massive amount of source to learn user behaviour when selecting passwords which in turn allow attacked to build more intelligent cracking tools.

So I'm not saying that your examples are less secure than having plain English passwords; what I'm saying is that such passwords isn't more secure these days. What is more secure is a random hash of characters or doing away with passwords entirely - which is what I actually advocated if you go back and re-read my post. ;)

Reply Parent Score: 2

RE[2]: make 'm long
by Soulbender on Mon 12th Nov 2012 02:11 in reply to "RE: make 'm long"
Soulbender Member since:
2005-08-18

4. Use one-time pads. Impossible to break with brute-force attacks.

Reply Parent Score: 2

RE[3]: make 'm long
by Laurence on Mon 12th Nov 2012 16:07 in reply to "RE[2]: make 'm long"
Laurence Member since:
2007-03-26

4. Use one-time pads. Impossible to break with brute-force attacks.

Funny enough I did write my own one-time pad routine when I was still at school.

The program was rather crude (I think I wrote it in Javascript and this was back in the 90s when Javascript largely sucked), but it did work.

Reply Parent Score: 2