4 ms·

My understanding is that when people build password-cracking dictionaries, they include common permutations in the script. That is, for the dictionary word "do

by Dove 14y ago

My understanding is that when people build password-cracking dictionaries, they include common permutations in the script. That is, for the dictionary word "dolphin", the script puts in "Dolphin" and "d0lph1n" and so forth. I'd be very surprised if someone building a table based on common quotations didn't do the same thing. I mean, how many memorable punctuation-mangling strategies are there on a common phrase anyway? I can only think of a few, right off; they're probably the ones most other people would think of, too. There is a very serious tendency to overestimate how clever and creative you can be in the 90 seconds you spend thinking about a password. Odds are, the "random" thing you're doing is the same random thing that a lot of other people are doing. And it's in someone's script somewhere. If you roll dice, instead of trusting your brain to be clever, you know what you have is random and hence secure.

commandar 14y ago
>I mean, how many memorable punctuation-mangling strategies are there on a common phrase anyway? How do you define common? The person has the entirety of literature, movies, music, etc to draw from. They might select any given fragment of a work, and the attacker has no way of knowing where the fragment begins or ends. Is a purely random key strictly more secure? Sure. But my goal isn't to get the purest possible level of security; it's to get normal people to use something more complex than the 8-14 character passwords they generally use now. I'm certainly not claiming it's perfect, but it's a simple to understand scheme that most non-technical users will be able to understand and use that will protect them from all but the most dedicated of attackers.
- Dove 14y ago
  They might select any given fragment of a work Just like someone told to select an arbitrary password might select any sequence of characters. They might theoretically select anything, but most of them will choose something like 'password'. So with your users. Star Trek fans are going to choose "makeitso". And a database of famous quotes will catch them.
  - Dove 14y ago
    What I'm really getting at, though, is that I think playing cat and mouse with professional hackers is a losing game. You shouldn't spend a few seconds trying to come up with something that they won't think of when it's their entire vocation. You're just not that creative, and too many people think alike. Just roll dice. That way your choice is provably random.

by Dove 14y ago

commandar 14y ago

>I mean, how many memorable punctuation-mangling strategies are there on a common phrase anyway? How do you define common? The person has the entirety of literature, movies, music, etc to draw from. They might select any given fragment of a work, and the attacker has no way of knowing where the fragment begins or ends. Is a purely random key strictly more secure? Sure. But my goal isn't to get the purest possible level of security; it's to get normal people to use something more complex than the 8-14 character passwords they generally use now. I'm certainly not claiming it's perfect, but it's a simple to understand scheme that most non-technical users will be able to understand and use that will protect them from all but the most dedicated of attackers.

Dove 14y ago
They might select any given fragment of a work Just like someone told to select an arbitrary password might select any sequence of characters. They might theoretically select anything, but most of them will choose something like 'password'. So with your users. Star Trek fans are going to choose "makeitso". And a database of famous quotes will catch them.
- Dove 14y ago
  What I'm really getting at, though, is that I think playing cat and mouse with professional hackers is a losing game. You shouldn't spend a few seconds trying to come up with something that they won't think of when it's their entire vocation. You're just not that creative, and too many people think alike. Just roll dice. That way your choice is provably random.