5 ms·
Nice overview. Found this a bit odd though: > The presence of easily crackable passwords on a network generally stems from a lack of password length (i.e., sh
by e12e 3y ago
Nice overview.
Found this a bit odd though:
> The presence of easily crackable passwords on a network generally stems from a lack of password length (i.e., shorter than 15 characters) and randomness (i.e., is not unique or can be guessed).
Randomness I get, but:
log2(72^15)~92
(alphanumeric including some symbols) and even only all lowercase:
log2(26^15)~70
I still think searching a 2^70 space is pretty hard? (Making big assumptions: no rainbow tables (proper salt), no daft ntlm 15=8+7, actually random characters).
- infogulch 3y agoA five word passphrase from a moderate length dictionary is like 80 bits, I don't understand why passphrases are not recommended in place of passwords more often.
- sgc 3y agoThey do nothing for me, because I want all my passwords to be unique. Which means I need a password manager no matter what.
- infogulch 3y agoI hope you use a passphrase to secure your password manager.
- Workaccount2 3y agothequickbrownfoxjumpsoverthelazydog They'll never guess it!
- sgc 3y agoIf you only need to remember one long password it is not really required, although admittedly convenient.
- mrguyorama 3y agoThe problem is that as soon as passphrases are common, it isn't 80 bits anymore, it's however many words you choose. It just becomes a slightly harder dictionary attack.
- deathanatos 3y ago…no? If you follow the scheme the person is suggesting, 80 bits of entropy is 80 bits, and it will take 80 bits "worth" of brute-force searching to crack a passphrase during such a search. If you're literally choosing "correct-horse-battery-staple", yeah, it's just a slightly harder dictionary attack, but that's not the suggestion being made, and that's not different than choosing hunter2 as a password.
- infogulch 3y agoCalculating bits of entropy of a passphrase with an equation for the bits of a random password is dumb. I'm calculating like log2((64k word dictionary size) ^ 5) = 80 bits. https://www.wolframalpha.com/input?i=log2%28%2864000%29+%5E+5%29 https://www.wolframalpha.com/input?i=log2%28%2864000%29+%5E+... I guarantee 5 words will be easier to remember than the 14 random characters required to get equal entropy from a random password from a dictionary of 58 characters. https://www.wolframalpha.com/input?i=solve+for+x+log2%28%2858%29+%5E+x%29+%3D+80 https://www.wolframalpha.com/input?i=solve+for+x+log2%28%285...
- numpad0 3y agoThe idea of "Correct Horse Battery Staple" password is it should take a sufficiently hard dictionary attack, like 2k candidates ^ 4 choices ~= 44 bits. You could do eight words random out of 2k dictionary and that's 87 bits in theory.
- numpad0 3y agoI don't know but five words takes five words worth of time, like 15s. That is not completely insignificant.
- infogulch 3y agoIt takes 15 seconds to type five words?! Ok fine maybe this is only for people who have learned to touch type (maybe you should learn to touch type).
- numpad0 3y agoTypical average wpm is 40, means 1.5s per word or 7.5s for five words, 15s is only double that. And that's for meaningful non-random sentences on desktop keyboards typed by under reasonable concentration.
- infogulch 3y agoI could always type my passphrase faster than normal sentences after a week.
- e12e 3y agoI'm not sure I'd call that a "moderate size" wordlist - I would rather pick 7 diceware words for ~70ish bits. The problem with really large lists, is you get some very rare and really long words.