6 ms·

Wow ... their online security rivals their airport security!!

by 13rules 14y ago

chris_wot 14y ago
With all these restrictions, I wonder how far they are reducing the possible key space? Some of these suggestions actually remove a number of permutations - like for instance you can't put in two digit years - this must remove a HUGE number of combinations! Then you remove ALL the dictionary words, all proper names, all the TSAs serial numbers, all reversed words - well, that's gotta make cracking an 8 letter password easier :-)
- DanBC 14y ago
  But most of those will be common passwords and already included on password lists. password72 is not more secure than password. username84 is not more secure than username.
  - chris_wot 14y ago
    Not quote my point. What I'm saying is that you make an assumption that 8 letters are used due to the ridiculous complexity requirements. Then you get all the possible combinations of letters and numbers for 8 character passwords. Then you remove all dictionary words and reversed words, all dictionary words (and reversed words) ending with a year, all combinations with repeats, all serial numbers and known patterns (like ABC). Then you further remove from this list all the combinations that don't have mixed case, a number and a special character. I'm interested in knowing how many possible passwords are left?
  - stcredzero 14y ago
    Getting your hands on the 1300000 common passwords and not allowing them would be a good start.
    - chris_wot 14y ago
      Do you not see the irony of talking about 1.3 million individual common passwords?
      - DanBC 14y ago
        No. Using 94 possible characters for an 8 character password means there are 6.09568939 × 10^15 possible passwords. Removing even 20million means you still have 6.09568937 × 10^15.
        stcredzero 14y ago
        Yes, and seeing the message that the password is already in a database used by cracking software should give users pause.
- m8urn 14y ago
  I actually did an analysis of that once but I can't seem to find it now. There actually is a pretty big reduction of keyspace (in the billions) but most of it is keyspace you don't want anyway. That is actually why the best policy is to have minimum length requirement of 12-14 characters and nothing else.
m8urn 14y ago
Yep, they won't even let you use "fingernail clippers" as a password.

Wow ... their online security rivals their airport security!!

by 13rules 14y ago

Wow ... their online security rivals their airport security!!

With all these restrictions, I wonder how far they are reducing the possible key space? Some of these suggestions actually remove a number of permutations - like for instance you can't put in two digit years - this must remove a HUGE number of combinations! Then you remove ALL the dictionary words, all proper names, all the TSAs serial numbers, all reversed words - well, that's gotta make cracking an 8 letter password easier :-)

DanBC 14y ago
But most of those will be common passwords and already included on password lists. password72 is not more secure than password. username84 is not more secure than username.
- chris_wot 14y ago
  Not quote my point. What I'm saying is that you make an assumption that 8 letters are used due to the ridiculous complexity requirements. Then you get all the possible combinations of letters and numbers for 8 character passwords. Then you remove all dictionary words and reversed words, all dictionary words (and reversed words) ending with a year, all combinations with repeats, all serial numbers and known patterns (like ABC). Then you further remove from this list all the combinations that don't have mixed case, a number and a special character. I'm interested in knowing how many possible passwords are left?
- stcredzero 14y ago
  Getting your hands on the 1300000 common passwords and not allowing them would be a good start.
  - chris_wot 14y ago
    Do you not see the irony of talking about 1.3 million individual common passwords?
    - DanBC 14y ago
      No. Using 94 possible characters for an 8 character password means there are 6.09568939 × 10^15 possible passwords. Removing even 20million means you still have 6.09568937 × 10^15.
      - stcredzero 14y ago
        Yes, and seeing the message that the password is already in a database used by cracking software should give users pause.
m8urn 14y ago
I actually did an analysis of that once but I can't seem to find it now. There actually is a pretty big reduction of keyspace (in the billions) but most of it is keyspace you don't want anyway. That is actually why the best policy is to have minimum length requirement of 12-14 characters and nothing else.

m8urn 14y ago

Yep, they won't even let you use "fingernail clippers" as a password.