Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Bugs & Viruses If you want to ensure you have adequate passwords but don't have the time or interest to study the topic, there's a useful basic article on how to devise strong passwords over at the NY Times. It summarizes key points in 9 simple rules of thumb. Also see the follow-up article for useful reader feedback. Stay safe!
Thread beginning with comment 542060
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[4]: make 'm long
by kwan_e on Mon 12th Nov 2012 02:48 UTC in reply to "RE[3]: make 'm long"
kwan_e
Member since:
2007-02-18

"I'm ignorant on these matters, but I don't see how passphrases could feasibly be cracked using dictionary based attacks.

The number of possible words and alternate "spellings" is large, especially if you consider multiple languages as you've mentioned.

While you're right that such attacks would require massive dictionary of words - it's still significantly more streamlined than a typical 'brute force attack' which will try every character combination individually.
"

But from the point of view of the cracker, a passphrase containing words is indistinguishable from a password of the same length with random letters, numbers and symbols.

First, they have to make the assumption that the passphrase is made of words, rather than just a long password. Then they have to test out combinations of words. So you have word choices of possibly over 10,000 words per word; you have alternative "spellings" of those words which can be a mixture of capitals and lower case and numbers making the word choice at least twice as many; then you have combinations of words for an unbounded number of words in the sentence. Then there's the problem of how the words are joined together.

A quick search doesn't turn up anything significant about dictionary based attacks on passhprases for me, so I don't know how much research has been done on it.

"
You also mentioned "without writing it down", but I was under the impression that was also out of date ideas about password protection. The chances of someone physically getting your password is practically zero, since most people won't risk it, most people aren't that important, and those who do risk stealing things generally aren't after written down passwords (assuming they know the username the person uses).

You're talking about 'security through obscurity' and that's a pretty bad philosophy to have.

There's been cases where 'normal' individuals like ourselves have become over-night public figures because of stories that break out in the press (eg relatives of crime suspects) and have subsequently been stalked over social media by reporters after a cheap story.

There's also cases about answer phone hacking that broke out earlier this year and many of those cases were against regular people.

And finally, regular people do get their accounts hacked all the time (eg my Paypal account was hacked a few years ago)

So don't think that your relative obscurity will protect you.
"
[/q]

I'm not talking about security through obscurity, but the relative unlikeliness that a password written down will be any less safe. Your hacked Paypal account was not hacked because you wrote down your password and it was copied somehow. None of the hacking cases, as far as I know, was because they wrote down the password.

The threat of hacking is not remedied by obscurity, but the stealing of passwords that are written down is mitigated by obscurity.

There's been a few articles in recent times about the whole "don't write down the password" being outdated advice. People regularly forgetting passwords and needing them to be reset opens up to many potential mim or phishing attacks posing as the password reset service.

Reply Parent Score: 2

RE[5]: make 'm long
by Laurence on Mon 12th Nov 2012 08:50 in reply to "RE[4]: make 'm long"
Laurence Member since:
2007-03-26

But from the point of view of the cracker, a passphrase containing words is indistinguishable from a password of the same length with random letters, numbers and symbols.

That's besides the point as crackers are using the method I described and for the reasons I've described. Hence why I advised using random characters instead.


First, they have to make the assumption that the passphrase is made of words, rather than just a long password.

they do make that assumption because they understand user habits when creating passwords. As I've already stated, so many passwords have been leaked in recent years that there's a wealth of data to build more intelligent routines. Gone are the days when "dumb" brute force attack was the preferred method of attack.


Then they have to test out combinations of words. So you have word choices of possibly over 10,000 words per word; you have alternative "spellings" of those words which can be a mixture of capitals and lower case and numbers making the word choice at least twice as many; then you have combinations of words for an unbounded number of words in the sentence. Then there's the problem of how the words are joined together.

Indeed, but that's still significantly permutations that a blind brute force attack.


A quick search doesn't turn up anything significant about dictionary based attacks on passhprases for me, so I don't know how much research has been done on it.

That's because, and as I've already stated, the old advice is still pretty much widespread. I've been following blogs of a number of security researchers in recent years (as my profession is moving into that arena) and the advice I'm giving is what I've read industry experts advice.

The only people I've seen that suggest otherwise are blogs by journalists and system administrators - which with the greatest of respect to them, are not working as close to this field to understand the latest developments in cracking. Much like how I wouldn't expect professional application develops to keep up with the latest security patches for *nix platforms. After all, IT is a massive field these days.

Anyhow, I'll have a dig out for some of the blogs I've read that supports these claims I'm making. If you don't mind checking back in a couple of hours ;)

Reply Parent Score: 2

RE[6]: make 'm long
by Laurence on Mon 12th Nov 2012 09:47 in reply to "RE[5]: make 'm long"
Laurence Member since:
2007-03-26

Here's a link describing how crackers now use dictionary based attacks:
http://arstechnica.com/security/2012/08/passwords-under-assault/

Reply Parent Score: 2

RE[5]: make 'm long
by Laurence on Mon 12th Nov 2012 09:15 in reply to "RE[4]: make 'm long"
Laurence Member since:
2007-03-26

(sorry for replying to you over two posts - i didn't spot the 2nd half of your reply until I'd already responded)

I'm not talking about security through obscurity, but the relative unlikeliness that a password written down will be any less safe.

Your hacked Paypal account was not hacked because you wrote down your password and it was copied somehow. None of the hacking cases, as far as I know, was because they wrote down the password.

Which is what "security through obscurity" means. I do sympathise with your sentiment, but discussing the likelihood of being targeted or having a stored password located does fall under security through obscurity. and while you are right that the likelihood is low, I'd rather offer up some genuine security advice instead of luring people into complacency. After all, unlikely scenarios do haven all the time.

The advice I have was to use a hash generator to provide a random password. This way you don't need to store passwords as you only need to remember 1 password (and the salt, but the salt will be your application / website name) and from that you can just generate your password each time you need to log in and you can guarantee to have the same password for that service each time.

Thus with my method, you have a random, unique and secure password for each service - and not be forced into a position of having to write your passwords down. it's a win-win.

Edited 2012-11-12 09:16 UTC

Reply Parent Score: 2