4 ms·
passwords will continue to be the weakest link in the chain for many systems until we start forcing uniqueness: every webmaster/admin cracks their collection o
by wepple 13y ago
passwords will continue to be the weakest link in the chain for many systems until we start forcing uniqueness:
every webmaster/admin cracks their collection of hashes against common wordlists, and if any given password appears too often (or at all, against a weak wordlist), user is forced to change it.
"But complex passwords are too difficult to remember"
Not necessarily:
JanesDogIsCalledHarry!9482
"Must I have a different one of those for every service?!"
Nope. ebay, twitter,facebook:
JanesDogEbIsCalledHarry!9482
JanesDogTwIsCalledHarry!9482
JanesDogFaIsCalledHarry!9482
also, as has been pointed out - bcrypt.
are there any hash ciphers that allow offline cost stretching yet?
- aidos 13y agoThat's not a good scheme to be promoting. If I have your twitter password, I have all your passwords. Also, by adding this restriction you are giving away the passwords of other users in the system.
- wepple 13y agoNo, that's the point of randomly modifying each password per system. The example was over simplified, but i guarantee you if you got one of my passwords you wouldn't work out where the per-system bit is.
- aidos 13y agoIf I got two of them I might though :) These days I just use a password manager with a big phrase for the master. I couldn't tell you what any of my other passwords are.