3 ms·
Ever run a dictionary cracker like hashcat? You really really should, with modern GPU hardware. Read the documentation too. Your example is a pretty early match
by kristopolous 4y ago
Ever run a dictionary cracker like hashcat? You really really should, with modern GPU hardware. Read the documentation too. Your example is a pretty early match. letter/number cycling, single case substitutions, symbol concatenation - GPUs can cycle through those in parallel, fast.
It's a guessable password + guessable ruleset. You've introduced far less entropy than you've imagined. If you want to have protection against attacks and use your technique, you have to come up with a ruleset you (1) don't see in the documentation (2) that's computationally unreasonable.
For instance, combine multiple languages. Strawberry Octopus Sundae, which is pretty memorable, can become
FragolaOctopusEisbecher combining Italian, English and German. And with that we just went O(N^3) where N is dictionary size (actually more than that because you've got a wide choice of latin scripted language).
That gives you far more protection then say sTr4b33ry+0ct0pu5!5und43. You aren't fooling a GeForce RTX 4090 with those tricks.
That's an example I just came up with though. There's lots of things like that. But really run a cracker. Try it out.
- Zurrrrr 4y agoThe example I gave isn't that guessable. It's combining things from different popculture into one new phrase that won't be in any dictionary. An even better attempt is to insert a whole word between two sides of a broken up word, e.g. `4mAzonij-0rdan4Npr7nces7`. And yes I use hashcat frequently. Using something like a 20 character password following that formula is going to be fine for most people - it isn't going to be brute forced before someone gets an alert that passwords are compromised and can change it. It's a much better solution IMO than using something entirely random and writing it down, or using something like LastPass.
- kristopolous 4y agoReally? Pop culture wordlists are insanely common and small - sometimes they're run Before general ones because they're fast to go through and have so many hits. This response isn't for you par se, I just don't want people to go off and think they're protected with beyonceMadonna because they read it on hacker news. Put your needles in the biggest haystacks you can find, not the rarefied air of celebrities. Also don't think you're protected with "old" names like GreenDayEminem. Using older celebrity lists to preference forgotten or abandoned accounts is another common technique. Sometimes you're just a stepping stone and not the target. Find a bigger crowd to get lost in. For instance, say an address + phone number of a place you remember that's not yours. 419FSt#201 is an old friend and 8184093100 is a friend I had in childhood. Those are two big crowds. Phone numbers have way more structure than you probably think but it's still a fairly big haystack.
- Zurrrrr 4y ago> Really? Pop culture wordlists are insanely common and small - sometimes they're run BEFORE the general ones because they're so fast to go through and have so many hits. That's the thing though, I'm talking about combining pop culture words in a way that they are not in any list. beyonceMadonna is quite a bit different from `b3Y0nm-Ad0nn\ac3` That's using two words from pop culture, merged together with numerous substitutions. It's easy to generate, easy to remember, and won't be in any lists, and shouldn't be bruteforced (well, I'd increase it to at least 20 from 16) in the time a breach is reported and a reasonable window for changing a password after being notified. I do agree with everything you've said though.
- loloquwowndueo 4y agoPretty sure fragola is Italian, not French. Entirely sure it’s not French for strawberry (fraise).
- kristopolous 4y agoYou're right. Corrected
- FrontierPsych 4y agoI have finally just started using completely and totally random upper/lowercase letters, numbers and special characters. No rhyme or reason. Usually 15 characters or more. That's ok, isn't it?
- kristopolous 4y agoMachine generated? yes. Human generated? no.
- FrontierPsych 4y agoHow in heck can a computer guess 15 human generated password? Can it guess a 58 character password that is human generated?