3 ms·

The Hubris System(R) provides adequate protection and is highly practical. The scheme is well known, but what attack against it outperforms an exhaustive search

by jmulho 9y ago

The Hubris System(R) provides adequate protection and is highly practical. The scheme is well known, but what attack against it outperforms an exhaustive search? How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. You will never catch me. Password cracking is an arms race. The crackers can't win. The math is against them. Every character I add to my password makes their problem exponentially harder. thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh

weinzierl 9y ago
>The Hubris System(R) provides adequate protection and is highly practical. If the protection is adequate is up to you, but as your phrases get longer they quickly get impractical and memorizing and entering will get error prone. >The scheme is well known, but what attack against it outperforms an exhaustive search? Everything that is not truly random has a pattern that can be exploited to outperform exhaustive search. >How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. Per position markov chains are one way. The point is, that as long as it isn't random there is a way to improve on simple brute force. >You will never catch me. Password cracking is an arms race. The crackers can't win. Cracking a single password is always hard but in a spear phishing attack there are often better ways anyway. Cracking passwords en mass is a different story and looking at the success rate for cracking passwords from leaks I'd say the crackers already won. There are also arguments why mass cracking gives an edge to the attacker [1]. >The math is against them. Every character I add to my password makes their problem exponentially harder. Longer passphrases quickly get impractical and as long as the character you add isn't random there is a way to guess it. >thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh 1. Good luck typing that without mistake. 2. Look closely on your passphrase, don't you see the patterns? [1] http://www.openwall.com/presentations/Passwords12-The-Future-Of-Hashing/ http://www.openwall.com/presentations/Passwords12-The-Future...

by jmulho 9y ago

weinzierl 9y ago

>The Hubris System(R) provides adequate protection and is highly practical. If the protection is adequate is up to you, but as your phrases get longer they quickly get impractical and memorizing and entering will get error prone. >The scheme is well known, but what attack against it outperforms an exhaustive search? Everything that is not truly random has a pattern that can be exploited to outperform exhaustive search. >How do you build a database of poetry I haven't written yet and will never publish? Frequency analysis may help, but many of my poems are about a yellow zebra named x-ray who plays the xylophone. If you come up with an attack that outperforms an exhaustive search, I will just write longer poems. Per position markov chains are one way. The point is, that as long as it isn't random there is a way to improve on simple brute force. >You will never catch me. Password cracking is an arms race. The crackers can't win. Cracking a single password is always hard but in a spear phishing attack there are often better ways anyway. Cracking passwords en mass is a different story and looking at the success rate for cracking passwords from leaks I'd say the crackers already won. There are also arguments why mass cracking gives an edge to the attacker [1]. >The math is against them. Every character I add to my password makes their problem exponentially harder. Longer passphrases quickly get impractical and as long as the character you add isn't random there is a way to guess it. >thspapaihp tsiwkbwaaioaes hdybadopihwyawnp famhbmompaaayznxwptx iycuwaatoaesiwjwlpywncm pciaartccwtmiateciatmpmtpeh 1. Good luck typing that without mistake. 2. Look closely on your passphrase, don't you see the patterns? [1] http://www.openwall.com/presentations/Passwords12-The-Future-Of-Hashing/ http://www.openwall.com/presentations/Passwords12-The-Future...