5 ms·

>What's more, WPA and WPA2 passwords require a minimum of eight characters, eliminating the possibility users will pick shorter passphrases that could be brute

>What's more, WPA and WPA2 passwords require a minimum of eight characters, eliminating the possibility users will pick shorter passphrases that could be brute forced in more manageable timeframes Should I point out that 'password' is 8 characters :) Have there been studies done that attempt to test the hypothesis that when forced to pick passwords that meet some arbitrary complexity threshold most common users pick things like "password1"? I have a hard time believing most non-techies (heck, even a lot of techies) pick secure passwords.

chimeracoder 14y ago
Anecdotally, most people I know without secure WIFI passwords pick things like: - Their address (sometimes with numerals spelled out) - Their last name - Their child's name - single (common) dictionary word - single (common) dictionary word + one or two digits.
- simba-hiiipower 14y ago
  for about 80% of protected home networks i’ve accessed the password ends up being someone in the home’s phone number.. not sure if it’s just because it’s often the only 8+ character string of numbers people readily have memorized or if it’s just lazy isp’s that set it that way (and lazy owners who never change it afterwards)..?
  - nivloc 14y ago
    It's the ISPs. Every time I move the tech resets my password to my home phone number. I'm sure it cuts down their support, but it usually means brute forcing only need worry about the last four digits.
  - moxie 14y ago
    Yep, in public compromises of large sets of WPA passphrases, more than 50% of them are phone numbers. This is why we offer a CloudCracker dictionary which includes every valid NANP number in it: https://www.cloudcracker.com/dictionaries.html https://www.cloudcracker.com/dictionaries.html
commandar 14y ago
One of the things I try very hard to drive home to people is that WPA2 uses a passphrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans are pretty adept at remembering, and turning it into a direct mnemonic for a more complicated passphrase.
- lotharbot 14y ago
  The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.
  - Buttons840 14y ago
    So throw an extra character in there somewhere.
  - commandar 14y ago
    WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. More importantly, any variations in punctuation, capitalization, spacing, etc would make a precomputed table worthless while still making the passphrase far easier for a human to remember than a random string of 8 characters.
    - ghayes 14y ago
      > More importantly, any variations in punctuation, capitalization, spacing Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection. It's worth noting that if we stripped whitespaces (and possibly some other common "could go both ways" features), we may be able to encourage people to choose higher entropy passwords.

chimeracoder 14y ago

Anecdotally, most people I know without secure WIFI passwords pick things like: - Their address (sometimes with numerals spelled out) - Their last name - Their child's name - single (common) dictionary word - single (common) dictionary word + one or two digits.

simba-hiiipower 14y ago
for about 80% of protected home networks i’ve accessed the password ends up being someone in the home’s phone number.. not sure if it’s just because it’s often the only 8+ character string of numbers people readily have memorized or if it’s just lazy isp’s that set it that way (and lazy owners who never change it afterwards)..?
- nivloc 14y ago
  It's the ISPs. Every time I move the tech resets my password to my home phone number. I'm sure it cuts down their support, but it usually means brute forcing only need worry about the last four digits.
- moxie 14y ago
  Yep, in public compromises of large sets of WPA passphrases, more than 50% of them are phone numbers. This is why we offer a CloudCracker dictionary which includes every valid NANP number in it: https://www.cloudcracker.com/dictionaries.html https://www.cloudcracker.com/dictionaries.html

commandar 14y ago

One of the things I try very hard to drive home to people is that WPA2 uses a passphrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans are pretty adept at remembering, and turning it into a direct mnemonic for a more complicated passphrase.

lotharbot 14y ago
The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.
- Buttons840 14y ago
  So throw an extra character in there somewhere.
- commandar 14y ago
  WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. More importantly, any variations in punctuation, capitalization, spacing, etc would make a precomputed table worthless while still making the passphrase far easier for a human to remember than a random string of 8 characters.
  - ghayes 14y ago
    > More importantly, any variations in punctuation, capitalization, spacing Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection. It's worth noting that if we stripped whitespaces (and possibly some other common "could go both ways" features), we may be able to encourage people to choose higher entropy passwords.