5 ms·

IANASE, but it feels pretty secure to me. Me, I rely on my growing up in the Swiss-German speaking part of Switzerland. Swiss-German is not a written language,

by slater 16y ago

IANASE, but it feels pretty secure to me. Me, I rely on my growing up in the Swiss-German speaking part of Switzerland. Swiss-German is not a written language, so basically any way you could write your (region- and dialect-specific) password variant means there's no dictionary attack available :D

pwg 16y ago
IANASE, but it feels pretty secure to me. It is not as secure as it seems. Think it through. There is an 11 character identical portion and a one character changing portion. Which means that each password differs from each other password by only one character. If the 11 character identical portion were to ever be revealed (i.e., think site that stores passwords in the clear having their password DB exposed) then I only have to try a very small number of possibilities to guess all the possible passwords from the 11 character stub. Not very secure at all, because the security of all the possible passwords depends entirely on that 11 character portion remaining a secret... Yet that 11 character portion is going to be handed to every site that requests a password. It is not a secret anymore once it is given to the first website. Therefore, not very secure at all.
- jaysonelliot 16y ago
  That is the crux of my concern. If a cracker were using an automated method of trying passwords that had been compromised, I would expect that they might simply get a failed attempt and move on. In a file of, say, a couple hundred thousand accounts, would they bother having an automatic retry with different characters? If it were someone getting the password and trying it manually, however, I could definitely see them figuring out that all they needed to do would be to change the first or last character, particularly if it were an obvious one, such as the first letter of the website or something. Clearly, I need to have a way to alternate multiple characters in a method that I can reliably remember.
  - pwg 16y ago
    What you have just described is exactly how the Jack-the-ripper password cracker program works. It starts with a set of "words" and then creates even more test words by doing just that, adding a character, deleting a character, etc. Not a problem for a computer.

by slater 16y ago

pwg 16y ago

IANASE, but it feels pretty secure to me. It is not as secure as it seems. Think it through. There is an 11 character identical portion and a one character changing portion. Which means that each password differs from each other password by only one character. If the 11 character identical portion were to ever be revealed (i.e., think site that stores passwords in the clear having their password DB exposed) then I only have to try a very small number of possibilities to guess all the possible passwords from the 11 character stub. Not very secure at all, because the security of all the possible passwords depends entirely on that 11 character portion remaining a secret... Yet that 11 character portion is going to be handed to every site that requests a password. It is not a secret anymore once it is given to the first website. Therefore, not very secure at all.

jaysonelliot 16y ago
That is the crux of my concern. If a cracker were using an automated method of trying passwords that had been compromised, I would expect that they might simply get a failed attempt and move on. In a file of, say, a couple hundred thousand accounts, would they bother having an automatic retry with different characters? If it were someone getting the password and trying it manually, however, I could definitely see them figuring out that all they needed to do would be to change the first or last character, particularly if it were an obvious one, such as the first letter of the website or something. Clearly, I need to have a way to alternate multiple characters in a method that I can reliably remember.
- pwg 16y ago
  What you have just described is exactly how the Jack-the-ripper password cracker program works. It starts with a set of "words" and then creates even more test words by doing just that, adding a character, deleting a character, etc. Not a problem for a computer.