7 ms·
For whole disk encryption (WDE) or any sort of password protected service where you cannot execute software (primary authentication), I encourage the use of pas
by 16s 14y ago
For whole disk encryption (WDE) or any sort of password protected service where you cannot execute software (primary authentication), I encourage the use of pass phrases. Dice ware is nice. Something such as this:
"lua ham purple day girl"
The challenge with primary authentication passwords is that users typically cannot use a password manager or generator to recall the password and thus must be able to recall something that they can easily type and end-up selecting weak passwords. There are some exceptions to this (yubikey, etc) but most normal users don't or cannot use them for various reasons, so go with a nice pass phrase like the one above.
- spuz 14y agoWhat qualifies as a crackable password for this tool? What is the maximum length and complexity you can handle?
- gnarbarian 14y agoHow much time do you have?
- cowsaysoink 14y agoFor disk encryption and keepass databases I like to go with full sentence but odd passphrases. Like: Cats and cows eat 200 tables a day. The grape is 14 shades of orange.
- nnnnni 14y agoPurple Monkey Dishwasher
- derleth 14y agoForego the cultural references here. (Should be obvious, but you have to assume the attacker is familiar with you in specific and can guess what you'll know.)
- dustinrodrigues 14y agocorrect horse battery staple
- dgesang 14y agoCan't wait to see some dox released where someone actually used this one. :)
- naner 14y agoIf we know the "algorithm" for your password choice (all lowercase, english words, space delimited, at least two words) that greatly reduces the time needed to guess the password. I wonder how much time that would take to crack on modern hardware...
- elithrar 14y ago> I wonder how much time that would take to crack on modern hardware... A very long time. You're still looking at a total of 3-5 words you need to guess (9-25 characters based on 3-5 letters per word), in the right combination, and assuming all words are English or popular colloquialisms... ("greatly reducing" is still not going to make brute forcing a realistic choice).
- naner 14y ago9-25 characters based on 3-5 letters per word It would still take a very long time but remember we're not iterating by character anymore. Each word is a 'character' and our alphabet is the english dictionary. So for the example above, we have to guess 5 slots in the passphrase and each slot has [number of words in english dict] possibilities. And also we'd probably start guessing assuming 2 word passphrases and have to exhaust all of 2, 3 and 4 before we start guessing 5 word combinations. So how rusty is your combinatorics? :)
- DanBC 14y agoThe GP mentioned diceware. You "only" have a dictionary of around 7000 words. A 5 word phrase is strong. A 6 word phrase is very strong.