5 ms·

Mine is not there, but how can assert that there are reasonable chances that it did not get cracked. I don't want to get paranoïd and I see no point in changin

Mine is not there, but how can assert that there are reasonable chances that it did not get cracked. I don't want to get paranoïd and I see no point in changing my password to minor services unless there is a really good chance that it got compromized. The "strong" versus "weak" message that some password checking services provide tells me nothing very usefull because what is weak when you focus a cluster of CPU for a week on may be "strong" for those who use the Gawker leak and don't have (I guess) such ressources.

mrspeaker 16y ago
It was encryted with DES. It's been compromised.
chaosfox 16y ago
>, but how can assert that there are reasonable chances that it did not get cracked. by using different passwords in each site ? you can't be sure, it's just a matter of time and desire, I have the time and resources, for instance, but no desire.
cleverjake 16y ago
Well those gauges are set by whomever sets them up, but they're almost always based on the same basic idea. Passwords that are mixed case, more than 8 characters and include non dictionary words, symbols and numbers are always going to be stronger than those who have only some of these. That is because that a majority of password attacks use either dictionaries (ala John the Ripper), which build multi-million word entries based on common phrases and misspellings of those words, or rainbow tables, which are themselves generally created with the same dictionaries, and have the resulting hash compared against the existing hash o the unknown password. As noted many times before, one of the biggest issues of the gawker passwords leak is that they were using des encryption. This truncated all passwords to 8 characters, which made it even easier to brute force the passwords, as exampleexample123 and examplee are treated exactly the same.
jgrahamc 16y ago
What was your Gawker username or email? Email me if you don't feel comfortable posting it here.

mrspeaker 16y ago

It was encryted with DES. It's been compromised.

chaosfox 16y ago

>, but how can assert that there are reasonable chances that it did not get cracked. by using different passwords in each site ? you can't be sure, it's just a matter of time and desire, I have the time and resources, for instance, but no desire.

cleverjake 16y ago

Well those gauges are set by whomever sets them up, but they're almost always based on the same basic idea. Passwords that are mixed case, more than 8 characters and include non dictionary words, symbols and numbers are always going to be stronger than those who have only some of these. That is because that a majority of password attacks use either dictionaries (ala John the Ripper), which build multi-million word entries based on common phrases and misspellings of those words, or rainbow tables, which are themselves generally created with the same dictionaries, and have the resulting hash compared against the existing hash o the unknown password. As noted many times before, one of the biggest issues of the gawker passwords leak is that they were using des encryption. This truncated all passwords to 8 characters, which made it even easier to brute force the passwords, as exampleexample123 and examplee are treated exactly the same.

jgrahamc 16y ago

What was your Gawker username or email? Email me if you don't feel comfortable posting it here.