3 ms·

Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried n

Actually, as the Ars technica articles have shown, it takes much more than that to protect from a dictionary attack with the speed that passwords can be tried now. http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...

diminoten 13y ago
A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.
- corin_ 13y ago
  No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)
  - diminoten 13y ago
    The specific phrase is or isn't easily crackable, that's as debatable as anything. It's not relevant to what I've been saying at all. What's not debatable is the fact that this dude "taught it to his wife" in a multi-month span. That's pants on head stupid. Combine that with "basically a wife", and the dehumanization/patronization was enough to piss me off, cryptographic overkill aside. Maybe that's just me. Whatever. But let's pretend we're talking about complication for a moment (a much more interesting conversation to all of us anyway), and then let's realize that this very sentence probably would take about a minute to memorize, and would be completely uncrackable. You're forgetting password cracking 101 - it gets a lot harder, even if the word/phrase only gets a little longer, or a little different. Sly dogs instead of lazy dogs, a hand in the bush is worth two in the bird, sally smells sea shores by the she shell, every fine boy does good; what do you want from me? You'd never crack any of those, and we both know it. Why? You'd never try them. You just wouldn't. Show me the algorithm that'd come up with, "No champions, play like excuses!" Only 32 characters, should be trivial. Right?
    - corin_ 13y ago
      You're still debating whether or not it's easily crackable. Let's imagine the phrase you were saying needs to be remembered is simply "password", whereas a phrase good enough to not be cracked actually needs to be 400 characters long and include punctuation and numbers. In that scenario, you would be thinking "should take 10 seconds to memorise", whereas realistically it takes much longer. That shows that the difficulty of phrase is of course relevant to how long it might take to learn, and the fact that other people have been arguing with you over how difficult the phrase needs to be shows that it is debatable. So maybe you're right that your example phrase is fine, but if his wife learned a much more complicated phrase then it could well take longer to remember.
      - diminoten 13y ago
        Yes, if what you ask us to imagine were what happened, then you'd be right. It didn't, however, so you are not. The difficulty of the phrase is not relevant to how long it might take to learn, because of how cryptography works. That is, a 60 character phrase is much harder to crack than a 58 character phrase. So, the difference between "password" and "this is the password I'm going to use from now until the end of eternity" is cryptographically large, but trivial, memorization wise. So while the difficulty of the phrase to crack just jumped into "not gonna happen" land, the difficulty of the memorization of the phrase moved from instantaneous to 5-10 minutes. If his wife learned a much more cryptographically complicated phrase it still would not have taken her longer to remember, making the specific phrase completely irrelevant. Two months is laughable, "taught it to my gf" is doubly laughable, and "gf (basically a wife)" is off the laughable charts.
- tehwalrus 13y ago
  58 characters made up of English words with spaces between, especially if the words form a sentence, is much less secure than 58 random characters. Of course, good luck memorising 58 random characters.
- jordanthoms 13y ago
  Actually, the issue with that phrase is that it's a common one, likely to be found on the web or in books - It's not just a collection of random words. You can't just consider the length of the passphrase.
- free652 13y ago
  Because if you don't use a passphrase for a long time you tend to forget it, especially if there are minor abnormalities in the phrase to defeat the dictionary attacks. And the phrase isn't in english, but in russian translit. Kinda like this: PustVsegdaBudetSolnze$PustVsegdaBuduYa Good luck cracking it.

diminoten 13y ago

A 58 character passphrase defeats all demonstrated examples in that article. But the point is being missed - two months? "I taught my wife in two months the passphrase"? Completely moronic.

corin_ 13y ago
No the point isn't being missed. How easy that phrase would be to crack is debatable and I don't know the correct answer, but let's assume that it is easy, you might need to make it more complicated. If this is the case, then the fact that a simple easy-to-crack phrase is easy to learn is irrelevant, like saying "it's quick to learn every word of French you'll ever need to speak - bonjour, oui, non". On the flip side, if you're right that the phrase is secure enough, then your argument is valid that it should be fairly quick to memorise. But the question of whether that phrase is good enough is entirely relevant and not missing the point. (You could still make the point that two months is two long for any phrase, I'm sure, but without knowing how much more complicated it is than your example, and without knowing how different people manage learning things, that's hard to say.)
- diminoten 13y ago
  The specific phrase is or isn't easily crackable, that's as debatable as anything. It's not relevant to what I've been saying at all. What's not debatable is the fact that this dude "taught it to his wife" in a multi-month span. That's pants on head stupid. Combine that with "basically a wife", and the dehumanization/patronization was enough to piss me off, cryptographic overkill aside. Maybe that's just me. Whatever. But let's pretend we're talking about complication for a moment (a much more interesting conversation to all of us anyway), and then let's realize that this very sentence probably would take about a minute to memorize, and would be completely uncrackable. You're forgetting password cracking 101 - it gets a lot harder, even if the word/phrase only gets a little longer, or a little different. Sly dogs instead of lazy dogs, a hand in the bush is worth two in the bird, sally smells sea shores by the she shell, every fine boy does good; what do you want from me? You'd never crack any of those, and we both know it. Why? You'd never try them. You just wouldn't. Show me the algorithm that'd come up with, "No champions, play like excuses!" Only 32 characters, should be trivial. Right?
  - corin_ 13y ago
    You're still debating whether or not it's easily crackable. Let's imagine the phrase you were saying needs to be remembered is simply "password", whereas a phrase good enough to not be cracked actually needs to be 400 characters long and include punctuation and numbers. In that scenario, you would be thinking "should take 10 seconds to memorise", whereas realistically it takes much longer. That shows that the difficulty of phrase is of course relevant to how long it might take to learn, and the fact that other people have been arguing with you over how difficult the phrase needs to be shows that it is debatable. So maybe you're right that your example phrase is fine, but if his wife learned a much more complicated phrase then it could well take longer to remember.
    - diminoten 13y ago
      Yes, if what you ask us to imagine were what happened, then you'd be right. It didn't, however, so you are not. The difficulty of the phrase is not relevant to how long it might take to learn, because of how cryptography works. That is, a 60 character phrase is much harder to crack than a 58 character phrase. So, the difference between "password" and "this is the password I'm going to use from now until the end of eternity" is cryptographically large, but trivial, memorization wise. So while the difficulty of the phrase to crack just jumped into "not gonna happen" land, the difficulty of the memorization of the phrase moved from instantaneous to 5-10 minutes. If his wife learned a much more cryptographically complicated phrase it still would not have taken her longer to remember, making the specific phrase completely irrelevant. Two months is laughable, "taught it to my gf" is doubly laughable, and "gf (basically a wife)" is off the laughable charts.
tehwalrus 13y ago
58 characters made up of English words with spaces between, especially if the words form a sentence, is much less secure than 58 random characters. Of course, good luck memorising 58 random characters.
jordanthoms 13y ago
Actually, the issue with that phrase is that it's a common one, likely to be found on the web or in books - It's not just a collection of random words. You can't just consider the length of the passphrase.
free652 13y ago
Because if you don't use a passphrase for a long time you tend to forget it, especially if there are minor abnormalities in the phrase to defeat the dictionary attacks. And the phrase isn't in english, but in russian translit. Kinda like this: PustVsegdaBudetSolnze$PustVsegdaBuduYa Good luck cracking it.