3 ms·

The example I gave isn't that guessable. It's combining things from different popculture into one new phrase that won't be in any dictionary. An even better att

The example I gave isn't that guessable. It's combining things from different popculture into one new phrase that won't be in any dictionary. An even better attempt is to insert a whole word between two sides of a broken up word, e.g. `4mAzonij-0rdan4Npr7nces7`. And yes I use hashcat frequently. Using something like a 20 character password following that formula is going to be fine for most people - it isn't going to be brute forced before someone gets an alert that passwords are compromised and can change it. It's a much better solution IMO than using something entirely random and writing it down, or using something like LastPass.

kristopolous 4y ago
Really? Pop culture wordlists are insanely common and small - sometimes they're run Before general ones because they're fast to go through and have so many hits. This response isn't for you par se, I just don't want people to go off and think they're protected with beyonceMadonna because they read it on hacker news. Put your needles in the biggest haystacks you can find, not the rarefied air of celebrities. Also don't think you're protected with "old" names like GreenDayEminem. Using older celebrity lists to preference forgotten or abandoned accounts is another common technique. Sometimes you're just a stepping stone and not the target. Find a bigger crowd to get lost in. For instance, say an address + phone number of a place you remember that's not yours. 419FSt#201 is an old friend and 8184093100 is a friend I had in childhood. Those are two big crowds. Phone numbers have way more structure than you probably think but it's still a fairly big haystack.
- Zurrrrr 4y ago
  > Really? Pop culture wordlists are insanely common and small - sometimes they're run BEFORE the general ones because they're so fast to go through and have so many hits. That's the thing though, I'm talking about combining pop culture words in a way that they are not in any list. beyonceMadonna is quite a bit different from `b3Y0nm-Ad0nn\ac3` That's using two words from pop culture, merged together with numerous substitutions. It's easy to generate, easy to remember, and won't be in any lists, and shouldn't be bruteforced (well, I'd increase it to at least 20 from 16) in the time a breach is reported and a reasonable window for changing a password after being notified. I do agree with everything you've said though.

kristopolous 4y ago

Really? Pop culture wordlists are insanely common and small - sometimes they're run Before general ones because they're fast to go through and have so many hits. This response isn't for you par se, I just don't want people to go off and think they're protected with beyonceMadonna because they read it on hacker news. Put your needles in the biggest haystacks you can find, not the rarefied air of celebrities. Also don't think you're protected with "old" names like GreenDayEminem. Using older celebrity lists to preference forgotten or abandoned accounts is another common technique. Sometimes you're just a stepping stone and not the target. Find a bigger crowd to get lost in. For instance, say an address + phone number of a place you remember that's not yours. 419FSt#201 is an old friend and 8184093100 is a friend I had in childhood. Those are two big crowds. Phone numbers have way more structure than you probably think but it's still a fairly big haystack.

Zurrrrr 4y ago
> Really? Pop culture wordlists are insanely common and small - sometimes they're run BEFORE the general ones because they're so fast to go through and have so many hits. That's the thing though, I'm talking about combining pop culture words in a way that they are not in any list. beyonceMadonna is quite a bit different from `b3Y0nm-Ad0nn\ac3` That's using two words from pop culture, merged together with numerous substitutions. It's easy to generate, easy to remember, and won't be in any lists, and shouldn't be bruteforced (well, I'd increase it to at least 20 from 16) in the time a breach is reported and a reasonable window for changing a password after being notified. I do agree with everything you've said though.