6 ms·

I've been using 20+ character Windows passwords for years and have literally never had a single problem with it.

by monochromatic 11y ago

CiPHPerCoder 11y ago
Try logging in with only the first 16 characters of your password rather than the full password.
- dsp1234 11y ago
  "the username or password is incorrect."
cbhl 11y ago
Silent password truncation isn't a problem that reveals itself until someone cracks the shorter NTLM hash.
- dsp1234 11y ago
  someone cracks the shorter NTLM hash. There are only two possible hashes stored in the SAM database. You mention the 'shorter' one, which would be the 'LM hash' which is restricted to 14 character passwords. However, LM hash storage has been disabled by default for all windows system since Vista / Windows Server 2008 (and ability to not store them was available, but not disabled by default since at least Windows 2000). Even Samba has had the ability to not generate or store the LM hash since at least 2002 (earliest search reference I could find).
  - Alupis 11y ago
    Try pointing something like L0phtCrack at your SAM database and see how quickly it shreds through all but the most complex NTLM and LM password hashes. Using something like john [the ripper] with a decent dictionary and applying mangling rules will shred through the rest. Not to mention, there's rainbow tables built and freely downloadable that contain every possible LM and NTLM hash (they're huge files, 30+ GB's, but if you need to crack in a hurry...).
    - Godel_unicode 11y ago
      > ...but the most complex... Those would be the passwords that we're talking about here. Next time you run either, take a look at the count of uncracked passwords. There are always some, which should tell you something. Also, I couldn't reply to you before so see my reply to parent WRT rainbow table size. They're not the panacea you're implying.
      - Alupis 11y ago
        > They're not the panacea you're implying. But they are - we have a hard-limited keyspace, with a fixed well-known and understood algorithm, which means, regardless of disk size, a rainbow table can (and has been) generated to cover the entire LM/NTLM space. This place just has a few for starters[1] [1] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm
        dsp1234 11y ago
        (and has been) generated to cover the entire LM/NTLM space I don't think this is true. Certainly true for the LM space of 7 characters, but the size of the NTML rainbow table for all passwords of length 1-9 with "only" mixed alphanumeric is 690GB with a key space of 13,759,005,997,841,642. This doesn't include the fact that a windows password can use any unicode character. So while there is could be some sort of collision with a shorter password, it's not really likely. Note that windows passwords can be up to 127 unicode characters, but that in win2k/2k3 the actual dialog box would only allow 32. So we're talking quite a bit more space to have each combination stored. Additionally, unless I'm doing some bad math here, it's just not currently possible to have a rainbow table that includes all possible MD4 hash values. An MD4 hash is 16 bytes, which is 128 bits. In order to just list each hash would take 16 bytes * 2^128 = 5 * 10^39 bytes, which is something like 5 * 10^27 terabytes, 5 * 10^13 yottabytes, etc. This doesn't include any space to list whatever password caused that hash to be calculated. And directly 'reversing' an MD4/NTLM hash still requires a preimage attack on MD4 and the current best known is still at a complexity of 2^121 [0], which would likely still be more feasible than having access to an MD4 rainbow table with all possible hash values. [0] - https://who.rocq.inria.fr/Gaetan.Leurent/files/MD4_FSE08.pdf https://who.rocq.inria.fr/Gaetan.Leurent/files/MD4_FSE08.pdf
  - Godel_unicode 11y ago
    In response to the existence of a rainbow table for "all possible hashes", consider that a rainbow table over all possible (ascii printable) characters with a maximum length of 8 characters is well over 400GB. These sizes grow factorially as the password length increases. [1] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm

I've been using 20+ character Windows passwords for years and have literally never had a single problem with it.

CiPHPerCoder 11y ago

Try logging in with only the first 16 characters of your password rather than the full password.

dsp1234 11y ago
"the username or password is incorrect."

cbhl 11y ago

Silent password truncation isn't a problem that reveals itself until someone cracks the shorter NTLM hash.

dsp1234 11y ago
someone cracks the shorter NTLM hash. There are only two possible hashes stored in the SAM database. You mention the 'shorter' one, which would be the 'LM hash' which is restricted to 14 character passwords. However, LM hash storage has been disabled by default for all windows system since Vista / Windows Server 2008 (and ability to not store them was available, but not disabled by default since at least Windows 2000). Even Samba has had the ability to not generate or store the LM hash since at least 2002 (earliest search reference I could find).
- Alupis 11y ago
  Try pointing something like L0phtCrack at your SAM database and see how quickly it shreds through all but the most complex NTLM and LM password hashes. Using something like john [the ripper] with a decent dictionary and applying mangling rules will shred through the rest. Not to mention, there's rainbow tables built and freely downloadable that contain every possible LM and NTLM hash (they're huge files, 30+ GB's, but if you need to crack in a hurry...).
  - Godel_unicode 11y ago
    > ...but the most complex... Those would be the passwords that we're talking about here. Next time you run either, take a look at the count of uncracked passwords. There are always some, which should tell you something. Also, I couldn't reply to you before so see my reply to parent WRT rainbow table size. They're not the panacea you're implying.
    - Alupis 11y ago
      > They're not the panacea you're implying. But they are - we have a hard-limited keyspace, with a fixed well-known and understood algorithm, which means, regardless of disk size, a rainbow table can (and has been) generated to cover the entire LM/NTLM space. This place just has a few for starters[1] [1] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm
      - dsp1234 11y ago
        (and has been) generated to cover the entire LM/NTLM space I don't think this is true. Certainly true for the LM space of 7 characters, but the size of the NTML rainbow table for all passwords of length 1-9 with "only" mixed alphanumeric is 690GB with a key space of 13,759,005,997,841,642. This doesn't include the fact that a windows password can use any unicode character. So while there is could be some sort of collision with a shorter password, it's not really likely. Note that windows passwords can be up to 127 unicode characters, but that in win2k/2k3 the actual dialog box would only allow 32. So we're talking quite a bit more space to have each combination stored. Additionally, unless I'm doing some bad math here, it's just not currently possible to have a rainbow table that includes all possible MD4 hash values. An MD4 hash is 16 bytes, which is 128 bits. In order to just list each hash would take 16 bytes * 2^128 = 5 * 10^39 bytes, which is something like 5 * 10^27 terabytes, 5 * 10^13 yottabytes, etc. This doesn't include any space to list whatever password caused that hash to be calculated. And directly 'reversing' an MD4/NTLM hash still requires a preimage attack on MD4 and the current best known is still at a complexity of 2^121 [0], which would likely still be more feasible than having access to an MD4 rainbow table with all possible hash values. [0] - https://who.rocq.inria.fr/Gaetan.Leurent/files/MD4_FSE08.pdf https://who.rocq.inria.fr/Gaetan.Leurent/files/MD4_FSE08.pdf
- Godel_unicode 11y ago
  In response to the existence of a rainbow table for "all possible hashes", consider that a rainbow table over all possible (ascii printable) characters with a maximum length of 8 characters is well over 400GB. These sizes grow factorially as the password length increases. [1] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm