4 ms·

Congrats on remembering your passwords, but this is a terrible way to generate them. Phrases that are relevant to you or your life are the second thing that som

by akerl_ 12y ago

Congrats on remembering your passwords, but this is a terrible way to generate them. Phrases that are relevant to you or your life are the second thing that somebody making a wordlist is going to aim for, after "password" and "letmein" and friends.

Someone1234 12y ago
I have a word list in front of me (2000 "short" and 10,000 "long" lists), "Forgive@h3r" "Quit@smoking4ever" "Save4trip@thailand" and none of his other passwords are listed on it. The way those passwords are constructed don't make them common enough to appear on most word lists and it would be very difficult for someone (who knows you or not) to guess them. Now, dates of birth, or other common profile information is commonly misused in passwords and that is guessable. But that isn't what the article was about and wasn't in their examples. I think the article rebuffs your post before you even posted it. So unless you can explain better how what the author is doing is insecure (and I highly doubt you can) your criticism seems misplaced.
- liveoneggs 12y ago
  I think it's clear that passwords should be VERY DIFFICULT for you to remember so that you have to reset them constantly and/or keep them in some kind of "vault" so you copy them into your clipboard all the time and accidentally paste them into chat rooms.
- dubcanada 12y ago
  Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common). Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol Tbh the best password he could have written would probably have been a sentence like I really should forgive my ex wife who I broke up with on May 23rd @ 8pm! https://xkcd.com/936/ https://xkcd.com/936/
  - saileshr 12y ago
    Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)
    - dubcanada 12y ago
      Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
      - itsybitsycoder 12y ago
        Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.
  - Someone1234 12y ago
    > Are you a password cracker? Is that a job title? I have cracked passwords before, yes. > Do you have a password cracker database in front of you? Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks. > Tbh the best password he could have written would probably have been a sentence like As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters. Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).
- x1798DE 12y ago
  The current largest danger, when it comes to passwords, is offline attacks on compromised databases, your computer, etc. Online attacks are much less of a problem because the server can (and hopefully does) throttle the number of times you can try - if you're limited to 100 tries, then it's pretty easy to create a password that won't be in the first 100 things a hacker will guess. For offline attacks, if the password is stored using something relatively insecure like SHA256 (which is not compromised, it's just too fast), it's very inexpensive to make billions of guesses per second against a hash like that. They'll go through a list of the top 10 million most common passwords, then start iterating through lists of combinations of common dictionary words. Most password cracking software is very smart and will try all kinds of substitutions. Assume that "Forgive" and "her" are in a dictionary of the 2000 most common words. Trying all 2-word combinations would be 2000^2 = 4 million guesses. They try with and without a special character (including a space) between them - assuming say 15 different characters, that's 60 million guesses. Try it with the first letter capitalized and uncapitalized, then also try each word alternately in all-caps (multiply by 5) 300 million guesses. Let's assume that each word, using common "1337" substitutions, has an average of 10 alternate forms - that's 3 billion guesses to cover the entire space of the 2000 most common words with all kinds of variations. On average your password will be about halfway through the list, so say 1.5 billion guesses to get there. If you used a $50 GPU, this would take maybe 10-20 seconds to complete. If you used ASICs designed for mining bitcoin, it would take much, much less than a second. Of course, the attackers might try other strategies. If they used a pure brute force, they'd never get to Forgive@her, but password cracking has gotten a lot smarter than that. You're basically taking a risk that this strategy (which is actually a subset of a more commonly used strategy) is not known by the hackers, because if it is, you'll be cracked very, very quickly. Best practice in password strategies is to assume that the hacker knows your exact strategy and calculate the entropy of the password. The best "bang for your buck" is fully random, random-case passwords with all special characters possible. Assuming a 96 character set, a 12-character password like that has about 10^23 combinations, so even making 100 trillion guesses per second would take 200 years. If you want to use words, effectively case insensitive, you'll probably need more characters (but fewer words) - a password of equivalent security drawn from a pool of 10,000 words would be 6 words long. You can obviously use a mix of strategies to get the balance you'd prefer.

by akerl_ 12y ago

Someone1234 12y ago

I have a word list in front of me (2000 "short" and 10,000 "long" lists), "Forgive@h3r" "Quit@smoking4ever" "Save4trip@thailand" and none of his other passwords are listed on it. The way those passwords are constructed don't make them common enough to appear on most word lists and it would be very difficult for someone (who knows you or not) to guess them. Now, dates of birth, or other common profile information is commonly misused in passwords and that is guessable. But that isn't what the article was about and wasn't in their examples. I think the article rebuffs your post before you even posted it. So unless you can explain better how what the author is doing is insecure (and I highly doubt you can) your criticism seems misplaced.

liveoneggs 12y ago
I think it's clear that passwords should be VERY DIFFICULT for you to remember so that you have to reset them constantly and/or keep them in some kind of "vault" so you copy them into your clipboard all the time and accidentally paste them into chat rooms.
dubcanada 12y ago
Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common). Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol Tbh the best password he could have written would probably have been a sentence like I really should forgive my ex wife who I broke up with on May 23rd @ 8pm! https://xkcd.com/936/ https://xkcd.com/936/
- saileshr 12y ago
  Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)
  - dubcanada 12y ago
    Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
    - itsybitsycoder 12y ago
      Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.
- Someone1234 12y ago
  > Are you a password cracker? Is that a job title? I have cracked passwords before, yes. > Do you have a password cracker database in front of you? Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks. > Tbh the best password he could have written would probably have been a sentence like As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters. Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).
x1798DE 12y ago
The current largest danger, when it comes to passwords, is offline attacks on compromised databases, your computer, etc. Online attacks are much less of a problem because the server can (and hopefully does) throttle the number of times you can try - if you're limited to 100 tries, then it's pretty easy to create a password that won't be in the first 100 things a hacker will guess. For offline attacks, if the password is stored using something relatively insecure like SHA256 (which is not compromised, it's just too fast), it's very inexpensive to make billions of guesses per second against a hash like that. They'll go through a list of the top 10 million most common passwords, then start iterating through lists of combinations of common dictionary words. Most password cracking software is very smart and will try all kinds of substitutions. Assume that "Forgive" and "her" are in a dictionary of the 2000 most common words. Trying all 2-word combinations would be 2000^2 = 4 million guesses. They try with and without a special character (including a space) between them - assuming say 15 different characters, that's 60 million guesses. Try it with the first letter capitalized and uncapitalized, then also try each word alternately in all-caps (multiply by 5) 300 million guesses. Let's assume that each word, using common "1337" substitutions, has an average of 10 alternate forms - that's 3 billion guesses to cover the entire space of the 2000 most common words with all kinds of variations. On average your password will be about halfway through the list, so say 1.5 billion guesses to get there. If you used a $50 GPU, this would take maybe 10-20 seconds to complete. If you used ASICs designed for mining bitcoin, it would take much, much less than a second. Of course, the attackers might try other strategies. If they used a pure brute force, they'd never get to Forgive@her, but password cracking has gotten a lot smarter than that. You're basically taking a risk that this strategy (which is actually a subset of a more commonly used strategy) is not known by the hackers, because if it is, you'll be cracked very, very quickly. Best practice in password strategies is to assume that the hacker knows your exact strategy and calculate the entropy of the password. The best "bang for your buck" is fully random, random-case passwords with all special characters possible. Assuming a 96 character set, a 12-character password like that has about 10^23 combinations, so even making 100 trillion guesses per second would take 200 years. If you want to use words, effectively case insensitive, you'll probably need more characters (but fewer words) - a password of equivalent security drawn from a pool of 10,000 words would be 6 words long. You can obviously use a mix of strategies to get the balance you'd prefer.