4 ms·

> Producing a good password without the help of a random generator on the other hand is simply impossible You just produced one: pagpwthoargotohisi

by jmulho 9y ago

weinzierl 9y ago
This kind of hubris is ecactly the reason why most [1] passwords are cracked so easily[2]. The scheme you applied is well known. Making a wordlists from every sentence of the HN dump should be doable. And why stop there? Project Gutenberg, the whole Wikipedia and other Wikimedia projects like Wikiquote are just a download away. A project I'm currently working on is facilitating the Google Ngram database for password cracking. I already generated almost 500 GiB of wordlists but haven't measured their success rate yet. [1] Good wordlists have a success rate around 70% against the common leaks. Running one of these lists against a set of fast hashes takes less than an hour on a plain average business notebook. [2] Assuming a fast hash, possibly salted. Slow hashes like bcrypt, scrypt, argon2, etc. are another story.
- jmulho 9y ago
  The Hubris System(R) provides adequate protection and is highly practical. The scheme is well known, but what attack against it outperforms an exhaustive search? How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. You will never catch me. Password cracking is an arms race. The crackers can't win. The math is against them. Every character I add to my password makes their problem exponentially harder. thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh
  - weinzierl 9y ago
    >The Hubris System(R) provides adequate protection and is highly practical. If the protection is adequate is up to you, but as your phrases get longer they quickly get impractical and memorizing and entering will get error prone. >The scheme is well known, but what attack against it outperforms an exhaustive search? Everything that is not truly random has a pattern that can be exploited to outperform exhaustive search. >How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. Per position markov chains are one way. The point is, that as long as it isn't random there is a way to improve on simple brute force. >You will never catch me. Password cracking is an arms race. The crackers can't win. Cracking a single password is always hard but in a spear phishing attack there are often better ways anyway. Cracking passwords en mass is a different story and looking at the success rate for cracking passwords from leaks I'd say the crackers already won. There are also arguments why mass cracking gives an edge to the attacker [1]. >The math is against them. Every character I add to my password makes their problem exponentially harder. Longer passphrases quickly get impractical and as long as the character you add isn't random there is a way to guess it. >thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh 1. Good luck typing that without mistake. 2. Look closely on your passphrase, don't you see the patterns? [1] http://www.openwall.com/presentations/Passwords12-The-Future-Of-Hashing/ http://www.openwall.com/presentations/Passwords12-The-Future...

> Producing a good password without the help of a random generator on the other hand is simply impossible You just produced one: pagpwthoargotohisi

by jmulho 9y ago

> Producing a good password without the help of a random generator on the other hand is simply impossible You just produced one: pagpwthoargotohisi

weinzierl 9y ago

This kind of hubris is ecactly the reason why most [1] passwords are cracked so easily[2]. The scheme you applied is well known. Making a wordlists from every sentence of the HN dump should be doable. And why stop there? Project Gutenberg, the whole Wikipedia and other Wikimedia projects like Wikiquote are just a download away. A project I'm currently working on is facilitating the Google Ngram database for password cracking. I already generated almost 500 GiB of wordlists but haven't measured their success rate yet. [1] Good wordlists have a success rate around 70% against the common leaks. Running one of these lists against a set of fast hashes takes less than an hour on a plain average business notebook. [2] Assuming a fast hash, possibly salted. Slow hashes like bcrypt, scrypt, argon2, etc. are another story.

jmulho 9y ago
The Hubris System(R) provides adequate protection and is highly practical. The scheme is well known, but what attack against it outperforms an exhaustive search? How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. You will never catch me. Password cracking is an arms race. The crackers can't win. The math is against them. Every character I add to my password makes their problem exponentially harder. thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh
- weinzierl 9y ago
  >The Hubris System(R) provides adequate protection and is highly practical. If the protection is adequate is up to you, but as your phrases get longer they quickly get impractical and memorizing and entering will get error prone. >The scheme is well known, but what attack against it outperforms an exhaustive search? Everything that is not truly random has a pattern that can be exploited to outperform exhaustive search. >How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. Per position markov chains are one way. The point is, that as long as it isn't random there is a way to improve on simple brute force. >You will never catch me. Password cracking is an arms race. The crackers can't win. Cracking a single password is always hard but in a spear phishing attack there are often better ways anyway. Cracking passwords en mass is a different story and looking at the success rate for cracking passwords from leaks I'd say the crackers already won. There are also arguments why mass cracking gives an edge to the attacker [1]. >The math is against them. Every character I add to my password makes their problem exponentially harder. Longer passphrases quickly get impractical and as long as the character you add isn't random there is a way to guess it. >thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh 1. Good luck typing that without mistake. 2. Look closely on your passphrase, don't you see the patterns? [1] http://www.openwall.com/presentations/Passwords12-The-Future-Of-Hashing/ http://www.openwall.com/presentations/Passwords12-The-Future...