6 ms·
Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account
by Udo 13y ago
Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix.
So, let's say for example, my current core is "kgA85kjF3". Then for example, I'd morph that for my Hacker News account to "ZkgA85kjF39!" and my fileserver as "UkgA85kjF3O2". I thought this was a good method of having reasonably long passwords but I'd have to memorize very little per site.
So imagine my surprise, when I created a new password "NkgA85kjF3T3", cracklib found a dictionary word in it. It got worse from there. Through experimentation, I determined that it was indeed the core that was compromised. Any password containing "kgA85kjF3" was compromised.
I have no idea how this happened. If this was not a big cosmic coincidence, if this is not just a random regex filter accident, that means data from at least two known password databases containing my cores has been correlated, and put into cracklib no less. There is really no limit to the imagination regarding what illegitimate databases might contain...
- icebraining 13y agoI do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.
- Udo 13y agoThat's a good procedure, a few weeks ago I'd have deemed you paranoid but obviously there is no practical limit to paranoia anymore ;) However, the hashing step makes it impractical for me on different devices in certain situations. I don't want to rely on browser extensions or apps either. So I'm changing my passwords to the output of an algorithm I can do in my head now.
- brandynwhite 13y agoFor those who aren't aware https://www.pwdhash.com/ https://www.pwdhash.com/
- icebraining 13y agoYeah, though I don't use it, since I only found out about it after I had been using my own system for a while.
- basch 13y agowhynotjustusereallylongpasswordsthatarehardformachinestocrack?
- Udo 13y agobecausetheyoftenfailwithwebsitesandit'skindofdifficultvaryingthemobscurelybutmeaningfullyenoughonapersitebasis.
- thinkpad20 13y agoitdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad
- Udo 13y agoThat's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.
- rfnslyr 13y agoBelieve me when I say all your personal information is on SOMEONES computer. Everyones is.
- Udo 13y agoI know. If I wanted my information to be "safe", I wouldn't have an online profile at all. For starters, I wouldn't use Google services. It's a matter of limiting exposure at this point. I know the NSA reads my email and can probably log into my home router, but I don't want everybody else to do the same. Otherwise, let's all change our passwords to "password" and be done with it. Just because protection isn't close to 100% doesn't mean I don't want any at all.
- thesimpsons1022 13y agocan you tell me more about what you mean? for instance if your wife sends you a nude picture through something like oovoo does that guarantee someone has stolen it?
- rfnslyr 13y agoIf you're connected to the world wide web and you send/receive data, there's a strong chance that either: a) Either sending/receiving machine is broken into b) Someone or something is intercepting your message c) The service you are using is broken into There's just too many holes to plug and too many people with expertise in these domains orders of magnitude above ours that they can use to either be malicious, or help our cause. Your computer/device needs to be secure. Your other parties devices need to be secure. Your connection needs to be secure. Your third parties service needs to be secure. The internet the third party uses needs to be secure. Their data centre needs to be secure. Then their ISP needs to be secure. All data is online.
- waynecochran 13y agoI hope only the crypto-hash of my password is stored.
- john2x 13y agoI do the same, and my "core" is less obscure than yours. I'm worried. What is this cracklib thing? Do I just provide it my password and it tells me stuff?
- Udo 13y agoIt's a linux library that checks passwords against a database of known words and patterns. You give it a password and it gives you basically one of two answers: "this is based on a known word" or "nope, never seen anything like it before". The database format looks highly obscure and doesn't lend itself to grepping without much effort.
- tlrobinson 13y agoIs there an easy way to check a password using cracklib via the command line? Preferably on OS X.
- Udo 13y agoIt doesn't come with OS X, but I suppose there should be a port available somewhere. Otherwise, Virtualbox and some minimal distro are probably your best bet. On Linux command line, you just feed the password to it: echo "password" | cracklib-check
- peferron 13y agobrew install cracklib cracklib-words echo "lol" | cracklib-check