3 ms·

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's mor

My work is also big on pass phrases but I kinda hate them. It's a lot of extra work to type it every time I unlock my PC. And more characters means there's more chance to make a typo meaning I have to do the whole thing again. And the weird way my brain works I have no issue remembering "G6bH,vIz#amV" so I still do it like that :) Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. What matters is online guessing and that is severely limited in the amount of attempts. I can't wait for passwordless though. I use only smart cards/yubikeys at home and love them.

yawaramin 5y ago
What's stopping you from using a random password like 'G6bH,vIz#amV'?
- GekkePrutser 5y ago
  Well they wanted to set the minimum length at 16 characters, for one :) But in the end they settled on 10 so it's ok. They even made it mandatory to have special chars and numbers if you have less than 16. So in the end it worked out fine for me but it did take some convincing (I was involved with the team that was making the choices). Tbh even if you do have to brute-force, if you know the company is using passphrases, it tends to be similar in terms of difficulty as a complex shorter password to brute force it. Because you can do a combined dictionary attack. And it's more susceptible to targeted attacks e.g. gathering a person's interests on facebook.
koolba 5y ago
> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash? > What matters is online guessing and that is severely limited in the amount of attempts. Belt and suspenders.
- franga2000 5y ago
  In pass-the-hash, the password doesn't matter. If you don't know the hash, it's equivalent to online brute-forcing a password of a fixed length, but since that length is usually more than the password itself, it's usually better breaking that. An NTML hash for example has >3× the entropy of a 6-word diceware password, but in an insane situation like 10-word diceware vs md5, brute-forcing the hash would be faster.
franga2000 5y ago
> They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. Ok, but that's a very Windows-specific issue. I don't know of any other widely-deployed system vulnerable to pass-the-hash.
- GekkePrutser 5y ago
  That's true but we're a Windows shop, sadly :) I'm a bit appalled at the security of AD with PTH, Kerberoast etc. In some cases you can even continue to use a nabbed ticket after the compromised account has been locked! That should never be possible IMO. I'd love to move on from AD personally. But you know... Legacy galore.

yawaramin 5y ago

What's stopping you from using a random password like 'G6bH,vIz#amV'?

GekkePrutser 5y ago
Well they wanted to set the minimum length at 16 characters, for one :) But in the end they settled on 10 so it's ok. They even made it mandatory to have special chars and numbers if you have less than 16. So in the end it worked out fine for me but it did take some convincing (I was involved with the team that was making the choices). Tbh even if you do have to brute-force, if you know the company is using passphrases, it tends to be similar in terms of difficulty as a complex shorter password to brute force it. Because you can do a combined dictionary attack. And it's more susceptible to targeted attacks e.g. gathering a person's interests on facebook.

koolba 5y ago

> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there. A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash? > What matters is online guessing and that is severely limited in the amount of attempts. Belt and suspenders.

franga2000 5y ago
In pass-the-hash, the password doesn't matter. If you don't know the hash, it's equivalent to online brute-forcing a password of a fixed length, but since that length is usually more than the password itself, it's usually better breaking that. An NTML hash for example has >3× the entropy of a 6-word diceware password, but in an insane situation like 10-word diceware vs md5, brute-forcing the hash would be faster.

franga2000 5y ago

> They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. Ok, but that's a very Windows-specific issue. I don't know of any other widely-deployed system vulnerable to pass-the-hash.

GekkePrutser 5y ago
That's true but we're a Windows shop, sadly :) I'm a bit appalled at the security of AD with PTH, Kerberoast etc. In some cases you can even continue to use a nabbed ticket after the compromised account has been locked! That should never be possible IMO. I'd love to move on from AD personally. But you know... Legacy galore.