5 ms·

How secure is my password?

10 points by hasenj 16y ago

nonameacct 16y ago
I am safe. "bobobobobobobobobobobobobobo" will take 8 octillian years. Actually, same for "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
- jwegan 16y ago
  Well in all fairness those are probably pretty good passwords. I would guess they are both extremely uncommon passwords. Furthermore any brute forcing algorithm is probably going to leave trying all 28 character passwords for the end since most people do not have passwords that long.
deleted 16y ago
[deleted]
kpanghmc 16y ago
Anyone else having a hard time reading the font on that page? It's not so bad on the landing page since there's only a handful of words, but the FAQ (http://howsecureismypassword.net/faq/ http://howsecureismypassword.net/faq/) hurts my eyes.
ElbertF 16y ago
Why would "(^%$@^$%" take a minute to crack and "aaaaaaaa" 5 hours? Anyway, nice try but I don't think I'll be giving you any of my actual passwords.
tptacek 16y ago
Donate. Donate! "Here's my password, and also five dollars." They are literally getting people to pay them to give up their passwords. This is the best social engineering attack I've ever seen.
- gdl 16y ago
  That was my first assumption too, but Wireshark doesn't show anything going across the network as I type, and nothing that looks incriminating when I click "donate" with text in the password box. It looks like it's entirely client-side JavaScript as it claims to be. Kind of disappointing, actually. edit: ...Unless it's clever enough to only be evil some fraction of the time. I didn't actually check through the code.
  - hasenj 16y ago
    Theoretically, it could store the password in a cookie, and later retrieve it, along with (somehow) a gmail id.
- jjguy 16y ago
  Is it April 1st? http://web.archive.org/web/20060412183431/http://www.nethash.org/ http://web.archive.org/web/20060412183431/http://www.nethash...
- jackowayed 16y ago
  Now they need to come up with an excuse for people to create accounts on the site so that they get their usernames.
ggordan 16y ago
It would take "About 487,375 nonillion years" to crack my gmail password. This made me smile
- TeHCrAzY 16y ago
  Well, somewhat less time, now that you have entered it into a random page on the internet :)
  - ggordan 16y ago
    Ah, no. I typed a password of the same length and same amount of lowercase, uppercase, digits, and 'special characters'. I was way too paranoid to type in my real password. As I've now come to realise was everyone else. I think the passwords you have on different services show how valuable that service is to you. For me, my Google Account is the most important account i have. It has a lot of information about me, and every other service I'm using. If anyone gets my Google Account, they've basically got my whole online identity. So because of that I try my best to make it safe. On the other hand, my Facebook/Twitter account have nothing of value, so while I wouldn't like them to get hacked, I don't feel the need to have a 28 character password.
- sathyabhat 16y ago
  It also told me it would take "About 3 quadrillion years" to crack my password of 11111111111111111111111111. Yeah.
spicyj 16y ago
The highest I could get by making up passwords was 565,892,495,532 nonillion years…
jcitme 16y ago
who knew that 'penis' was in the top 500?
- tjarratt 16y ago
  I'm really doubting that "vagina" is in the top 500. They must be counting these as basic dictionary lookups and discounting them that way. Any good password cracker would definitely try a dictionary attack before brute force.
nelhage 16y ago
I was really hoping for something like "It would take N years to crack your password ... but now I know it, so why bother?"
WillyF 16y ago
There's no way that I'm putting my password in there, but I did make up a password that mimics mine to see how secure it is.
hasenj 16y ago
For the record, the site is not mine. Obviously you shouldn't put your actual password there, just use the same pattern. If you want to test 'keh@8R2', replace it with something like 'mnk$6D3'
ahlatimer 16y ago
To the people who are worried about giving up their password, who cares if he gets them? Are passwords really even that worthwhile without being able to tie them to some account on some site? Let's say that one of my passwords is n0TMyR34lP4sSw0rD, and I enter that into the site. So what? Now you have to guess my username on a site that I might have an account on. Not to mention weeding through all the garbage from people entering in random passwords just to see what the results are. I understand that being proactive about security is a good thing, but I really think the potential of this being successfully used maliciously is fairly non-existent.
- ElbertF 16y ago
  They could create a database with hashes of these passwords and compare them with the recently leaked Gawker hashes. Not all of those passwords have been cracked yet, especially the more complex ones.
sukuriant 16y ago
Hm .... is it really true that aardvarkstasteawesome would really take a quadrillion years to find? Since that's 3 different words, wouldn't a dictionary attack catch that one pretty fast? Disclaimer: I've never, to my knowledge, eaten an aardvark. Also, this is not my password anywhere.

10 points by hasenj 16y ago

I am safe. "bobobobobobobobobobobobobobo" will take 8 octillian years. Actually, same for "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"

jwegan 16y ago
Well in all fairness those are probably pretty good passwords. I would guess they are both extremely uncommon passwords. Furthermore any brute forcing algorithm is probably going to leave trying all 28 character passwords for the end since most people do not have passwords that long.

deleted 16y ago

[deleted]

kpanghmc 16y ago

Anyone else having a hard time reading the font on that page? It's not so bad on the landing page since there's only a handful of words, but the FAQ (http://howsecureismypassword.net/faq/ http://howsecureismypassword.net/faq/) hurts my eyes.

ElbertF 16y ago

Why would "(^%$@^$%" take a minute to crack and "aaaaaaaa" 5 hours? Anyway, nice try but I don't think I'll be giving you any of my actual passwords.

tptacek 16y ago

Donate. Donate! "Here's my password, and also five dollars." They are literally getting people to pay them to give up their passwords. This is the best social engineering attack I've ever seen.

gdl 16y ago
That was my first assumption too, but Wireshark doesn't show anything going across the network as I type, and nothing that looks incriminating when I click "donate" with text in the password box. It looks like it's entirely client-side JavaScript as it claims to be. Kind of disappointing, actually. edit: ...Unless it's clever enough to only be evil some fraction of the time. I didn't actually check through the code.
- hasenj 16y ago
  Theoretically, it could store the password in a cookie, and later retrieve it, along with (somehow) a gmail id.
jjguy 16y ago
Is it April 1st? http://web.archive.org/web/20060412183431/http://www.nethash.org/ http://web.archive.org/web/20060412183431/http://www.nethash...
jackowayed 16y ago
Now they need to come up with an excuse for people to create accounts on the site so that they get their usernames.

ggordan 16y ago

It would take "About 487,375 nonillion years" to crack my gmail password. This made me smile

TeHCrAzY 16y ago
Well, somewhat less time, now that you have entered it into a random page on the internet :)
- ggordan 16y ago
  Ah, no. I typed a password of the same length and same amount of lowercase, uppercase, digits, and 'special characters'. I was way too paranoid to type in my real password. As I've now come to realise was everyone else. I think the passwords you have on different services show how valuable that service is to you. For me, my Google Account is the most important account i have. It has a lot of information about me, and every other service I'm using. If anyone gets my Google Account, they've basically got my whole online identity. So because of that I try my best to make it safe. On the other hand, my Facebook/Twitter account have nothing of value, so while I wouldn't like them to get hacked, I don't feel the need to have a 28 character password.
sathyabhat 16y ago
It also told me it would take "About 3 quadrillion years" to crack my password of 11111111111111111111111111. Yeah.

spicyj 16y ago

The highest I could get by making up passwords was 565,892,495,532 nonillion years…

jcitme 16y ago

who knew that 'penis' was in the top 500?

tjarratt 16y ago
I'm really doubting that "vagina" is in the top 500. They must be counting these as basic dictionary lookups and discounting them that way. Any good password cracker would definitely try a dictionary attack before brute force.

nelhage 16y ago

I was really hoping for something like "It would take N years to crack your password ... but now I know it, so why bother?"

WillyF 16y ago

There's no way that I'm putting my password in there, but I did make up a password that mimics mine to see how secure it is.

hasenj 16y ago

For the record, the site is not mine. Obviously you shouldn't put your actual password there, just use the same pattern. If you want to test 'keh@8R2', replace it with something like 'mnk$6D3'

ahlatimer 16y ago

To the people who are worried about giving up their password, who cares if he gets them? Are passwords really even that worthwhile without being able to tie them to some account on some site? Let's say that one of my passwords is n0TMyR34lP4sSw0rD, and I enter that into the site. So what? Now you have to guess my username on a site that I might have an account on. Not to mention weeding through all the garbage from people entering in random passwords just to see what the results are. I understand that being proactive about security is a good thing, but I really think the potential of this being successfully used maliciously is fairly non-existent.

ElbertF 16y ago
They could create a database with hashes of these passwords and compare them with the recently leaked Gawker hashes. Not all of those passwords have been cracked yet, especially the more complex ones.

sukuriant 16y ago

Hm .... is it really true that aardvarkstasteawesome would really take a quadrillion years to find? Since that's 3 different words, wouldn't a dictionary attack catch that one pretty fast? Disclaimer: I've never, to my knowledge, eaten an aardvark. Also, this is not my password anywhere.