Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Bugs & Viruses If you want to ensure you have adequate passwords but don't have the time or interest to study the topic, there's a useful basic article on how to devise strong passwords over at the NY Times. It summarizes key points in 9 simple rules of thumb. Also see the follow-up article for useful reader feedback. Stay safe!
Thread beginning with comment 542027
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: make 'm long
by Laurence on Sun 11th Nov 2012 20:49 UTC in reply to "RE[2]: make 'm long"
Laurence
Member since:
2007-03-26


Use lower case: 26 possibilities
Use upper case: 26 possibilities
Use numbers: 10 possibilities
Use punctuation: 32 possibilites
Use them all: 94 possibilities per character

Using English is the easiest way to fall victim to dictionary attacks. Put in another language and suddenly the cracker would have to include 20+ dictionaries. Put in a dialect and the cracker would need to put 2000+ dictionaries in.

How can you possibly claim that increasing the possibilities is _not_ more secure?

You're missing my point. Modern attacks aren't the old style brute force attacks which would try every combination of character. Instead they have every more sophisticated dictionaries (I'm not sure if those are hardcoded possibilities or heuristics).

The problem is we've had an influx of leaked passwords over recent years. Nearly every month another website gets hacked and passwords are leaked - and this provides a massive amount of source to learn user behaviour when selecting passwords which in turn allow attacked to build more intelligent cracking tools.

So I'm not saying that your examples are less secure than having plain English passwords; what I'm saying is that such passwords isn't more secure these days. What is more secure is a random hash of characters or doing away with passwords entirely - which is what I actually advocated if you go back and re-read my post. ;)

Reply Parent Score: 2

RE[4]: make 'm long
by kwan_e on Mon 12th Nov 2012 03:13 in reply to "RE[3]: make 'm long"
kwan_e Member since:
2007-02-18

You're missing my point. Modern attacks aren't the old style brute force attacks which would try every combination of character. Instead they have every more sophisticated dictionaries (I'm not sure if those are hardcoded possibilities or heuristics).

The problem is we've had an influx of leaked passwords over recent years. Nearly every month another website gets hacked and passwords are leaked - and this provides a massive amount of source to learn user behaviour when selecting passwords which in turn allow attacked to build more intelligent cracking tools.


You're kind of switching the bait here.

The second paragraph only provides knowledege for old style single-word passwords. A passphrase is made up of multiple words, which is much more difficult to analyse behaviour.

Assuming that the cracker somehow can distinguish a passphrase from a long password, they're just confronted with using an almost brute force attack on the word combinations.

Using a 10,000 word dictionary, a passphrase of five words is a space of 100,000,000,000,000,000,000 possibilities. The English language alone has about 250,000 words depending on the OED estimate.

Reply Parent Score: 2

RE[5]: make 'm long
by Laurence on Mon 12th Nov 2012 09:08 in reply to "RE[4]: make 'm long"
Laurence Member since:
2007-03-26


You're kind of switching the bait here.

I'm really not. I might not be explaining things that well (English isn't me strongest skill), but my advice here has been consistent.


The second paragraph only provides knowledege for old style single-word passwords. A passphrase is made up of multiple words, which is much more difficult to analyse behaviour.

You're making an assumption that dictionary attacks can only work against a single instance within the dictionary file. What modern dictionary attacks actually do is use a the dictionary as a basis for a "brute force-style" attack.

Let me explain this better:
the old style brute force attack would try every character permutation (eg (if you don't mind some crude regex) m/[0-9a-zA-Z]/ and any symbols opted for).

Modern dictionary attacks use the dictionary as a bases for building the permutations. So if the dictionary file has: add, dad, bad then the attack will use add, dad, bad, addadd, adddad, addbad, dadadd, daddad, dadbad, badadd, baddad, badbad plus the "l33t" variants ("d4d") formating variants ("dad dad", "dad!") and so on.

So while it's technically still a dictionary based attack, it's significantly more sophisticated than a standard dictionary attack yet also significantly quicker to run through likely permutations than the old style brute force attack.


Assuming that the cracker somehow can distinguish a passphrase from a long password, they're just confronted with using an almost brute force attack on the word combinations.

Using a 10,000 word dictionary, a passphrase of five words is a space of 100,000,000,000,000,000,000 possibilities. The English language alone has about 250,000 words depending on the OED estimate.

Indeed. But the point is that's still massively quicker than doing every character permutation.

To put it another way, you stated that 5 word match might offer up 10^19 combinations (which I think is an over-estimate, but I'm still willing to use those figures), using a standard brute force attack offers up (10+26+26+20)^16 combinations (10 numeric characters, 26 alpha in both cases and 20 symbols) for a 16 character sequence. That works out at 2044140858654976 possible solutions and that's not even the entire length of an average 5 word string (which is what you're basing your example on).

So an intelligent dictionary attack really is the better cracking routing and why you have to assume that attackers are using it.

Reply Parent Score: 2