4 ms·

Oh yes, and I do use this in my own passphrases for the added combinational complexity. I just wanted to point out to the naive that using `passw0rd` or `s3cr3t

Oh yes, and I do use this in my own passphrases for the added combinational complexity. I just wanted to point out to the naive that using `passw0rd` or `s3cr3t`, they are in password lists that a brute force attack will use. My point that crackers will programaticaly try this was less relevant.

nostrademons 16y ago
You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word? Patrick's point is that there are combinatorially many different ways that you can 133t!fy a password, so they don't really help in dictionary attacks.
- JoeAltmaier 16y ago
  I know I am annoyed by "keyspace rules" that actually reduce the keyspace (rant). So, I capitalize the 1 letter and put 0 or 1 at the end - voila! IT appeased. Am I the only one? No. So the 'keyspace rules' don't accomplish anything, and may actually reduce the keyspace.
- redthrowaway 16y ago
  >passw0rd may be in the dictionary, but is p4ssword, or pa$$word? I'm guessing yes. If I were building a dictionary, I would add every password that's been dumped from sites like Gawker, etc. With hundreds of thousands of passwords floating around in the ether, you can quite quickly cover common leetifications. Also, it's trivially easy to leetify algorithmically, so padding a dictionary wouldn't be difficult. You'll run into space issues eventually, but you can easily split the dictionary over several machines. The best solution for the user is to pick a fairly complex, long, and unique password. Server-side, assume your database will be compromised use something like bcrypt to make cracking it computationally expensive.
- tripzilch 16y ago
  > You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word? yes they are. well, actually, password cracking software (most used is Jack the Ripper) comes with a bunch of commandline tools that allow you to do substitutions and common variations to your password lists. generally, when trying to crack a specific target, you start with a few "seed" password lists (common passwords, but also lists of target-specific jargon), and then apply the transformation tools on those to expand your lists. say you'd want to crack accounts at an aviator forum, you'd include a list of airplane types and aviation jargon. then you'd apply the transformation tools, and you'll end up with boeing Boeing b0eing Bo3!ng, etc. check this guy's blog, he writes about how it's (usually) done: http://www.skullsecurity.org/blog/2010/the-ultimate-faceoff-between-password-lists http://www.skullsecurity.org/blog/2010/the-ultimate-faceoff-... (analysis of leaked password lists) http://www.skullsecurity.org/blog/?s=ripper http://www.skullsecurity.org/blog/?s=ripper (describes Jack the Ripper in these articles)

nostrademons 16y ago

You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word? Patrick's point is that there are combinatorially many different ways that you can 133t!fy a password, so they don't really help in dictionary attacks.

JoeAltmaier 16y ago
I know I am annoyed by "keyspace rules" that actually reduce the keyspace (rant). So, I capitalize the 1 letter and put 0 or 1 at the end - voila! IT appeased. Am I the only one? No. So the 'keyspace rules' don't accomplish anything, and may actually reduce the keyspace.
redthrowaway 16y ago
>passw0rd may be in the dictionary, but is p4ssword, or pa$$word? I'm guessing yes. If I were building a dictionary, I would add every password that's been dumped from sites like Gawker, etc. With hundreds of thousands of passwords floating around in the ether, you can quite quickly cover common leetifications. Also, it's trivially easy to leetify algorithmically, so padding a dictionary wouldn't be difficult. You'll run into space issues eventually, but you can easily split the dictionary over several machines. The best solution for the user is to pick a fairly complex, long, and unique password. Server-side, assume your database will be compromised use something like bcrypt to make cracking it computationally expensive.
tripzilch 16y ago
> You can choose to l33tify different combinations of letters in the password. passw0rd may be in the dictionary, but is p4ssword, or pa$$word? yes they are. well, actually, password cracking software (most used is Jack the Ripper) comes with a bunch of commandline tools that allow you to do substitutions and common variations to your password lists. generally, when trying to crack a specific target, you start with a few "seed" password lists (common passwords, but also lists of target-specific jargon), and then apply the transformation tools on those to expand your lists. say you'd want to crack accounts at an aviator forum, you'd include a list of airplane types and aviation jargon. then you'd apply the transformation tools, and you'll end up with boeing Boeing b0eing Bo3!ng, etc. check this guy's blog, he writes about how it's (usually) done: http://www.skullsecurity.org/blog/2010/the-ultimate-faceoff-between-password-lists http://www.skullsecurity.org/blog/2010/the-ultimate-faceoff-... (analysis of leaked password lists) http://www.skullsecurity.org/blog/?s=ripper http://www.skullsecurity.org/blog/?s=ripper (describes Jack the Ripper in these articles)