5 ms·

Using newer cracking techniques[1], pass-phrases are as quick to crack as many others. I honestly think password managers should not exist without the ability t

Using newer cracking techniques[1], pass-phrases are as quick to crack as many others. I honestly think password managers should not exist without the ability to randomly generate new passwords. 1. https://hashcat.net/oclhashcat/ https://hashcat.net/oclhashcat/

satysin 10y ago
For sure in an ideal world all users would have a password manager that generates 60+ character long passwords that are unique to every service but sadly that probably won't happen for a long time.
- imtringued 10y ago
  In an ideal world we wouldn't have blackhat hackers. A more practical solution is to simply generate a public/private key pair on registration.
DanBC 10y ago
oclhashcat is weak against a properly chosen 7 word diceware phrase.
Someone1234 10y ago
That is why, with a pass phrase, the number of WORDS should be equal to the number of LETTERS in a random alphanumeric password. So if the password rule is 8 truly random characters, you should be aiming for 8 words in your pass phrase password. This is an easy rule to remember and to teach people. The actual explanation for this is a little complex and includes things like the average person's vocabulary, known sentence structure inc. transition words, language itself, and enigma cracking techniques. The biggest criticism phrase based passwords receive is that people go from an 8 character random password to a three word phrase-based password and then act like they've improved security because it contains more characters. Phrase based passwords can be secure with a little bit of education, even against the best available crackers.
herbst 10y ago
I was honestly surprised when i touched that software again after many years and more than one major hardware upgrade. 7 Chars WPA2 would be cracked within a few seconds, 8 chars takes like 10 minutes or a little more. And i dont even own a really good graphic card.

satysin 10y ago

For sure in an ideal world all users would have a password manager that generates 60+ character long passwords that are unique to every service but sadly that probably won't happen for a long time.

imtringued 10y ago
In an ideal world we wouldn't have blackhat hackers. A more practical solution is to simply generate a public/private key pair on registration.

DanBC 10y ago

oclhashcat is weak against a properly chosen 7 word diceware phrase.

Someone1234 10y ago

That is why, with a pass phrase, the number of WORDS should be equal to the number of LETTERS in a random alphanumeric password. So if the password rule is 8 truly random characters, you should be aiming for 8 words in your pass phrase password. This is an easy rule to remember and to teach people. The actual explanation for this is a little complex and includes things like the average person's vocabulary, known sentence structure inc. transition words, language itself, and enigma cracking techniques. The biggest criticism phrase based passwords receive is that people go from an 8 character random password to a three word phrase-based password and then act like they've improved security because it contains more characters. Phrase based passwords can be secure with a little bit of education, even against the best available crackers.

herbst 10y ago

I was honestly surprised when i touched that software again after many years and more than one major hardware upgrade. 7 Chars WPA2 would be cracked within a few seconds, 8 chars takes like 10 minutes or a little more. And i dont even own a really good graphic card.