6 ms·

Interesting I'll take a look. I need a backup system for my gf (basically a wife) to decrypt my drive in case of my passing. I had a truecrypt volume, now I swi

by free652 13y ago

Interesting I'll take a look. I need a backup system for my gf (basically a wife) to decrypt my drive in case of my passing. I had a truecrypt volume, now I switched back to OSX encryption. It's basically a drive (in a safe deposit box) with all of my stuff there, also with a copy of my lastpass passwords unencrypted. My gf knows our phrase, 50 characters no less. Took me few months to teach her it.

x0054 13y ago
Few months? How about "anAardvarkAndAHippoAreNeverFriends@" easy to remember and almost impossible to brake. Worst case, lets say that attacker actually knows that the password is 6 words with a special character at the end. Lets further assume that the attacker knows that the words are not overly complicated, say from a subset of 5,000, and the special character is one of the 10 that's easy to type on the keyboard. Even than, at the speed of 10 million passwords per second it would take 500 million years (just about) to crack that one, and no need for months of memorization.
- gnur 13y ago
  Not true, see this article for more information. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo... Passphrases are not more secure then regular passwords by default, the problem is that a lot of people use phrases that follow simple grammar. Capital first letters of each word, a sentence that is actually valid and no spelling mistakes make it a lot easier to crack then 50 random characters (or 20 random characters). Passphrases that work are random sequences of words that have spelling mistakes, random capitalization, aren't found in any book/song/poem and preferably mix several languages. The famous "correct horse battery staple" is better then your example, I have memorized 20 random words from 3 languages and use those words in some combination in all my passwords.
diminoten 13y ago
Here's a 58 character phrase: You always find something in the very last place you look. I wonder how many months it'd take to learn that. :-/
- balabaster 13y ago
  Except now that'll be the first place I'll look :D
- dmix 13y ago
  I would have at least 1-2 slang/leet-speak words in there to counter dictionary attacks.
  - jordanthoms 13y ago
    Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried now. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
    - diminoten 13y ago
      A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.
      - corin_ 13y ago
        No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)

by free652 13y ago

x0054 13y ago

Few months? How about "anAardvarkAndAHippoAreNeverFriends@" easy to remember and almost impossible to brake. Worst case, lets say that attacker actually knows that the password is 6 words with a special character at the end. Lets further assume that the attacker knows that the words are not overly complicated, say from a subset of 5,000, and the special character is one of the 10 that's easy to type on the keyboard. Even than, at the speed of 10 million passwords per second it would take 500 million years (just about) to crack that one, and no need for months of memorization.

gnur 13y ago
Not true, see this article for more information. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo... Passphrases are not more secure then regular passwords by default, the problem is that a lot of people use phrases that follow simple grammar. Capital first letters of each word, a sentence that is actually valid and no spelling mistakes make it a lot easier to crack then 50 random characters (or 20 random characters). Passphrases that work are random sequences of words that have spelling mistakes, random capitalization, aren't found in any book/song/poem and preferably mix several languages. The famous "correct horse battery staple" is better then your example, I have memorized 20 random words from 3 languages and use those words in some combination in all my passwords.

diminoten 13y ago

Here's a 58 character phrase: You always find something in the very last place you look. I wonder how many months it'd take to learn that. :-/

balabaster 13y ago
Except now that'll be the first place I'll look :D
dmix 13y ago
I would have at least 1-2 slang/leet-speak words in there to counter dictionary attacks.
- jordanthoms 13y ago
  Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried now. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
  - diminoten 13y ago
    A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.
    - corin_ 13y ago
      No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)