4 ms·

Removing attack surface make it viable to continuously monitor. I don’t think it is an either/or. Just out of curiosity has anyone with a cryptographically str

Removing attack surface make it viable to continuously monitor. I don’t think it is an either/or. Just out of curiosity has anyone with a cryptographically strong ssh password ever been hacked via the password authentication path unless they gave this password to someone else?

tptacek 8y ago
I don't know what "cryptographically strong" means in the context of a password, but I do know people with strong SSH passwords that got owned up, yes. Don't use "cryptographically strong" passwords with SSH. Use keys, disable passwords.
- danieltillett 8y ago
  I mean a password with enough entropy that also hasn't been used before and is not shared with anyone. Do you know how they were owned? Is there a write up anywhere as this is a super interesting topic.
- IncRnd 8y ago
  For passwords "cryptographically strong" normally means a password with appropriate complexity and sometimes unpredictability requirements, since entropy is almost nonexistent in passwords.
  - namibj 8y ago
    Something out of pwgen or diceware would do though. If your application has length requirements that preclude the latter, make sure they are liable if you loose something due to preventing you from using a secure password. (No one can remember a short secure Password for more than a small handful of applications.)
- weavie 8y ago
  > but I do know people with strong SSH passwords that got owned up By having their password brute forced, or some other means?
- sunstone 8y ago
  So for example, a 16 character random password is still vulnerable?
  - danieltillett 8y ago
    This is what I would like to know. If strong ssh passwords can be broken then there is a bigger issue than just turn off ssh password log in.
    - sunstone 8y ago
      I am pretty sure that 16 character random passwords are safe from dictionary attacks, and I suspect you and I are using the same process for protecting these passwords. tptacek is leary of our process while you and I are leary of the certs getting out of our control without our knowledge. Security is a handful of trade offs.

tptacek 8y ago

I don't know what "cryptographically strong" means in the context of a password, but I do know people with strong SSH passwords that got owned up, yes. Don't use "cryptographically strong" passwords with SSH. Use keys, disable passwords.

danieltillett 8y ago
I mean a password with enough entropy that also hasn't been used before and is not shared with anyone. Do you know how they were owned? Is there a write up anywhere as this is a super interesting topic.
IncRnd 8y ago
For passwords "cryptographically strong" normally means a password with appropriate complexity and sometimes unpredictability requirements, since entropy is almost nonexistent in passwords.
- namibj 8y ago
  Something out of pwgen or diceware would do though. If your application has length requirements that preclude the latter, make sure they are liable if you loose something due to preventing you from using a secure password. (No one can remember a short secure Password for more than a small handful of applications.)
weavie 8y ago
> but I do know people with strong SSH passwords that got owned up By having their password brute forced, or some other means?
sunstone 8y ago
So for example, a 16 character random password is still vulnerable?
- danieltillett 8y ago
  This is what I would like to know. If strong ssh passwords can be broken then there is a bigger issue than just turn off ssh password log in.
  - sunstone 8y ago
    I am pretty sure that 16 character random passwords are safe from dictionary attacks, and I suspect you and I are using the same process for protecting these passwords. tptacek is leary of our process while you and I are leary of the certs getting out of our control without our knowledge. Security is a handful of trade offs.