4 ms·
My big takeaway from this article is that passwords, in almost any form, are a bad way to secure your information. The only acceptable way to use a password no
by Corrado 13y ago
My big takeaway from this article is that passwords, in almost any form, are a bad way to secure your information. The only acceptable way to use a password nowadays is to use a password manager to build huge passwords that a human could never remember or type in reliably. Even then, as machines get faster and crackers get smarter, these behemoth passwords will fall.
I've been using 2-factor authentication (Google Auth) lately and I'm fairly impressed with it. I only have to whip out my cell phone a couple of times a day/month so It's fairly convenient, and it seems very secure. Then again, I thought my password was fairly secure, but after reading this story and the HN comments, I can say that I'm just like everyone else when it comes to passwords. Ignorant. :/
- gradstudent 13y agoThe "exponential wall" means the longer your password is the less likely it is to fall. A 10 letter password is in a 26^10 keyspace. Add one more letter and it takes 10 times longer to crack -- assuming of course your password is not part of some of some combination of short common dictionary words. What I find really interesting is that the same kind of attack vector (combinations of common words) is being used as the basis for some really sophisticated search techniques in Artificial Intelligence. I remember reading an abstract a few years ago from a student of Rich Korf @ UCLA. In it the authors use this kind of approach to attack the 24-Sliding-Tile Puzzle. Here's a link; it's pretty cool! http://www.aaai.org/ocs/index.php/AAAI/AAAI11/paper/view/3496/4146 http://www.aaai.org/ocs/index.php/AAAI/AAAI11/paper/view/349...
- rdl 13y agonot 10x longer, 26x longer (and that's assuming lowercase a-z only)
- deleted 13y ago[deleted]
- aidenn0 13y agoEven then, as machines get faster and crackers get smarter, these behemoth passwords will fall. This is fairly trivial to show is false. A 256-bit password that can be checked at one clock-cycle per iteration with 1 million cores running at 30GHz will take 1.2e53 years to crack[1]. If you generate it by base-64 encoding a random 256-bit string you will end up with only a 12 character password (hardly a "behemoth"). [edit] It's 1.2e53 years to exhaust the search space; you can expect to crack X% of the passwords in X% of the time (or have an X% chance of cracking a single password in X% of the time) [1] https://www.google.com/search?q=2%5E256%2F(1e6*30e6%2Fs)#sclient=psy-ab&q=2%5E256%2F(1e6*30e9%2Fs)+in+years&oq=2%5E256%2F(1e6*30e9%2Fs)+in+years&gs_l=serp.3...20618.20919.2.21126.2.1.1.0.0.0.72.72.1.1.0...0.0...1c.1.14.psy-ab.ZGlsPlrbkKo&pbx=1&bav=on.2,or.r_cp.r_qf.&bvm=bv.47008514,d.cGE&fp=cd0a8e3ae15128af&biw=1351&bih=906 https://www.google.com/search?q=2%5E256%2F(1e6*30e6%2Fs)#scl...
- traplens 13y agoOne note here - base-64 encoding a 256-bit string would result in a 44 character password (43 without padding). It would be pretty cool if a 12 character password gave you 256 bits of entropy though :)
- aidenn0 13y agoYou're right; I did 256/8 in my head and got the obviously wrong result of 8 rather than 32.