3 ms·

Here's a 58 character phrase: You always find something in the very last place you look. I wonder how many months it'd take to learn that. :-/

balabaster 13y ago
Except now that'll be the first place I'll look :D
dmix 13y ago
I would have at least 1-2 slang/leet-speak words in there to counter dictionary attacks.
- jordanthoms 13y ago
  Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried now. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
  - diminoten 13y ago
    A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.
    - corin_ 13y ago
      No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)
      - diminoten 13y ago
        The specific phrase is or isn't easily crackable, that's as debatable as anything. It's not relevant to what I've been saying at all. What's not debatable is the fact that this dude "taught it to his wife" in a multi-month span. That's pants on head stupid. Combine that with "basically a wife", and the dehumanization/patronization was enough to piss me off, cryptographic overkill aside. Maybe that's just me. Whatever. But let's pretend we're talking about complication for a moment (a much more interesting conversation to all of us anyway), and then let's realize that this very sentence probably would take about a minute to memorize, and would be completely uncrackable. You're forgetting password cracking 101 - it gets a lot harder, even if the word/phrase only gets a little longer, or a little different. Sly dogs instead of lazy dogs, a hand in the bush is worth two in the bird, sally smells sea shores by the she shell, every fine boy does good; what do you want from me? You'd never crack any of those, and we both know it. Why? You'd never try them. You just wouldn't. Show me the algorithm that'd come up with, "No champions, play like excuses!" Only 32 characters, should be trivial. Right?
        corin_ 13y ago
        You're still debating whether or not it's easily crackable. Let's imagine the phrase you were saying needs to be remembered is simply "password", whereas a phrase good enough to not be cracked actually needs to be 400 characters long and include punctuation and numbers. In that scenario, you would be thinking "should take 10 seconds to memorise", whereas realistically it takes much longer. That shows that the difficulty of phrase is of course relevant to how long it might take to learn, and the fact that other people have been arguing with you over how difficult the phrase needs to be shows that it is debatable. So maybe you're right that your example phrase is fine, but if his wife learned a much more complicated phrase then it could well take longer to remember.
        diminoten 13y ago
        Yes, if what you ask us to imagine were what happened, then you'd be right. It didn't, however, so you are not. The difficulty of the phrase is not relevant to how long it might take to learn, because of how cryptography works. That is, a 60 character phrase is much harder to crack than a 58 character phrase. So, the difference between "password" and "this is the password I'm going to use from now until the end of eternity" is cryptographically large, but trivial, memorization wise. So while the difficulty of the phrase to crack just jumped into "not gonna happen" land, the difficulty of the memorization of the phrase moved from instantaneous to 5-10 minutes. If his wife learned a much more cryptographically complicated phrase it still would not have taken her longer to remember, making the specific phrase completely irrelevant. Two months is laughable, "taught it to my gf" is doubly laughable, and "gf (basically a wife)" is off the laughable charts.
    - tehwalrus 13y ago
      58 characters made up of English words with spaces between, especially if the words form a sentence, is much less secure than 58 random characters. Of course, good luck memorising 58 random characters.
    - jordanthoms 13y ago
      Actually, the issue with that phrase is that it's a common one, likely to be found on the web or in books - It's not just a collection of random words. You can't just consider the length of the passphrase.
    - free652 13y ago
      Because if you don't use a passphrase for a long time you tend to forget it, especially if there are minor abnormalities in the phrase to defeat the dictionary attacks. And the phrase isn't in english, but in russian translit. Kinda like this: PustVsegdaBudetSolnze$PustVsegdaBuduYa Good luck cracking it.
- diminoten 13y ago
  A dictionary attack? Are you kidding me? You don't know it's alphabetic, you don't know it's an actual English phrase, you don't know how long it is, you don't basically know jack shit to be able to effectively use a dictionary attack against a password like that. You don't know it's a passphrase, basically.
  - nwh 13y ago
    A phrase like that is very easy to crack actually. People have been cracking brain wallets in the Bitcoin world (think storing all your money behind a passphrase that anybody can access, madness!) with greater complexity than that. From the person in questions posts, they're trawling wikipedia, quote databases, movie scripts, anything you can imagine to find phrases that people might use for passwords. It seems to work too, judging by the number of times I've encountered this person saying "hey, that's me, I stole those!". The fact that there's google results for that phrase means it's a useless passphrase.
    - dmix 13y ago
      Indeed, sure it's long(ish) but it's trivialized by the commonality of the words it contains.
    - diminoten 13y ago
      It's simply not, due to the fact that you don't know it's a passphrase. You know nothing about the password, you will never get to trying it.
      - nwh 13y ago
        You underestimate people. More often than not people will use a quote like the example in the parents post did. In a world of custom FPGA devices to crack passwords, it wouldn't take long.
        diminoten 13y ago
        Okay, than show me. Show me the algorithm that'd crack the password I just came up with.
deleted 13y ago
[deleted]

balabaster 13y ago

Except now that'll be the first place I'll look :D

dmix 13y ago

I would have at least 1-2 slang/leet-speak words in there to counter dictionary attacks.

jordanthoms 13y ago
Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried now. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
- diminoten 13y ago
  A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.
  - corin_ 13y ago
    No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)
    - diminoten 13y ago
      The specific phrase is or isn't easily crackable, that's as debatable as anything. It's not relevant to what I've been saying at all. What's not debatable is the fact that this dude "taught it to his wife" in a multi-month span. That's pants on head stupid. Combine that with "basically a wife", and the dehumanization/patronization was enough to piss me off, cryptographic overkill aside. Maybe that's just me. Whatever. But let's pretend we're talking about complication for a moment (a much more interesting conversation to all of us anyway), and then let's realize that this very sentence probably would take about a minute to memorize, and would be completely uncrackable. You're forgetting password cracking 101 - it gets a lot harder, even if the word/phrase only gets a little longer, or a little different. Sly dogs instead of lazy dogs, a hand in the bush is worth two in the bird, sally smells sea shores by the she shell, every fine boy does good; what do you want from me? You'd never crack any of those, and we both know it. Why? You'd never try them. You just wouldn't. Show me the algorithm that'd come up with, "No champions, play like excuses!" Only 32 characters, should be trivial. Right?
      - corin_ 13y ago
        You're still debating whether or not it's easily crackable. Let's imagine the phrase you were saying needs to be remembered is simply "password", whereas a phrase good enough to not be cracked actually needs to be 400 characters long and include punctuation and numbers. In that scenario, you would be thinking "should take 10 seconds to memorise", whereas realistically it takes much longer. That shows that the difficulty of phrase is of course relevant to how long it might take to learn, and the fact that other people have been arguing with you over how difficult the phrase needs to be shows that it is debatable. So maybe you're right that your example phrase is fine, but if his wife learned a much more complicated phrase then it could well take longer to remember.
        diminoten 13y ago
        Yes, if what you ask us to imagine were what happened, then you'd be right. It didn't, however, so you are not. The difficulty of the phrase is not relevant to how long it might take to learn, because of how cryptography works. That is, a 60 character phrase is much harder to crack than a 58 character phrase. So, the difference between "password" and "this is the password I'm going to use from now until the end of eternity" is cryptographically large, but trivial, memorization wise. So while the difficulty of the phrase to crack just jumped into "not gonna happen" land, the difficulty of the memorization of the phrase moved from instantaneous to 5-10 minutes. If his wife learned a much more cryptographically complicated phrase it still would not have taken her longer to remember, making the specific phrase completely irrelevant. Two months is laughable, "taught it to my gf" is doubly laughable, and "gf (basically a wife)" is off the laughable charts.
  - tehwalrus 13y ago
    58 characters made up of English words with spaces between, especially if the words form a sentence, is much less secure than 58 random characters. Of course, good luck memorising 58 random characters.
  - jordanthoms 13y ago
    Actually, the issue with that phrase is that it's a common one, likely to be found on the web or in books - It's not just a collection of random words. You can't just consider the length of the passphrase.
  - free652 13y ago
    Because if you don't use a passphrase for a long time you tend to forget it, especially if there are minor abnormalities in the phrase to defeat the dictionary attacks. And the phrase isn't in english, but in russian translit. Kinda like this: PustVsegdaBudetSolnze$PustVsegdaBuduYa Good luck cracking it.
diminoten 13y ago
A dictionary attack? Are you kidding me? You don't know it's alphabetic, you don't know it's an actual English phrase, you don't know how long it is, you don't basically know jack shit to be able to effectively use a dictionary attack against a password like that. You don't know it's a passphrase, basically.
- nwh 13y ago
  A phrase like that is very easy to crack actually. People have been cracking brain wallets in the Bitcoin world (think storing all your money behind a passphrase that anybody can access, madness!) with greater complexity than that. From the person in questions posts, they're trawling wikipedia, quote databases, movie scripts, anything you can imagine to find phrases that people might use for passwords. It seems to work too, judging by the number of times I've encountered this person saying "hey, that's me, I stole those!". The fact that there's google results for that phrase means it's a useless passphrase.
  - dmix 13y ago
    Indeed, sure it's long(ish) but it's trivialized by the commonality of the words it contains.
  - diminoten 13y ago
    It's simply not, due to the fact that you don't know it's a passphrase. You know nothing about the password, you will never get to trying it.
    - nwh 13y ago
      You underestimate people. More often than not people will use a quote like the example in the parents post did. In a world of custom FPGA devices to crack passwords, it wouldn't take long.
      - diminoten 13y ago
        Okay, than show me. Show me the algorithm that'd crack the password I just came up with.

deleted 13y ago

[deleted]