The new password craze...

[Red Storm]

I remember one site needed me to not only put in my password (that had to be changed every few months and the new one couldn't be at all similar), but you also had to deal with a captcha every time!

 

[NikolaeVarius]

Because it would guess that combo with a exclamation and first letter cap? How long would it take? If it's less than 60 days, then yes it's a worry. But if it's more than 60 days, no worries.

Even if it was a concern, you could still write a human relate-able password with the same basic idea.

"Ippon wins 1 match!"

How is that less secure than 5rdxXSW@ ?

Because with a dictionary attack, it doesn't have to bother trying out every single iteration of any possible character for every space. things wrapped in quotations are extremely common, as well as capitalizing the first word in a sentence. They add much less variability than you would think, especially if you think replacing a with @ or e with 3 is a ton of variability.

Also you should be comparing equal length passwords, so its more like

"Ippon wins 1 match!"
vs
w!26*fg%s895!sim.d

One is harder to guess than the other. The first one has a direct method of attack. The second one, really only brute force is going to work against it.

First one could probably be broken in under a week. Easy.

 

[s0me0nesmind1]

If thats true, very good to know. I was always under the impression that mixing in numbers/symbols in the middle of the password was always the best way for security - I guess under the principle that bruteforcer's usually go by wordlists... hence... words... not symbols/numbber/letter mix.

However, a simple flaw is limitations in PW lengths. Unless you enjoy having 12 length of that PW on this site, 8 lenth of that PW on that site, etc.. etc... you will be constantly changing such a long PW. If were talking Windows login and thats it... well, thats different.

 

[Codewiz]

If thats true, very good to know. I was always under the impression that mixing in numbers/symbols in the middle of the password was always the best way for security - I guess under the principle that bruteforcer's usually go by wordlists... hence... words... not symbols/numbber/letter mix.

the main problem is that some sites (apple id) do not allow spaces.

 

[Rakehellion]

http://arstechnica.com/security/201...eling-the-next-frontier-of-password-cracking/

passwords are quickly becoming damn near useless

Well, that's mostly an MD5 problem, but worth noting nonetheless.

 

[Rakehellion]

the main problem is that some sites (apple id) do not allow spaces.

There are about a hundred other characters you can use besides a space.

 

[Phoenix86]

IT doesn't decide that... Management and vendors do.

Fixed. We're limited by the systems the vendors supply and the rules management wants to apply.

I have a plasma burn table that's computer operated. IT implemented and maintains the system but we did not choose the vendor nor do we operate it. It's the same thing with everything else.

 

[silverpig]

hunter2

 

[Train]

Password is Taco

 

[silverpig]

http://arstechnica.com/security/201...eling-the-next-frontier-of-password-cracking/

Everyone should read this article. Correct battery horse staple will go down quite quickly under these methods. Sure, it will take a long time to brute force, but these attacks don't use brute force. Dictionaries with substitution rules, password lists, etc all cut down the time it takes dramatically.

To the poster who uses the 4-letter algorithm, I do something similar but it won't really help either. Basically, the article states that if the algorithm is simple enough for you to remember, then it exists as a rule in some password cracking algorithm somewhere, and a computer can run it faster than you can.

With security/recovery questions being the stupidly easy way to get passwords nowadays, I am basically resigned to the notion that my passwords exist just to keep out accidental logins and people trying 5 times to guess my password via birthday and name combinations.

 

[Wyndru]

If only we lived in a world where complete SSO was a reality. But unfortunately standardization more complex than that.

I wouldn't mind the periodic changing of only 1 password at my organization, but having multiple passwords requires me to have a piece of paper hidden under my keyboard. :whiste:

 

[Train]

Everyone should read this article. Correct battery horse staple will go down quite quickly under these methods. Sure, it will take a long time to brute force, but these attacks don't use brute force. Dictionaries with substitution rules, password lists, etc all cut down the time it takes dramatically.

To the poster who uses the 4-letter algorithm, I do something similar but it won't really help either. Basically, the article states that if the algorithm is simple enough for you to remember, then it exists as a rule in some password cracking algorithm somewhere, and a computer can run it faster than you can.

With security/recovery questions being the stupidly easy way to get passwords nowadays, I am basically resigned to the notion that my passwords exist just to keep out accidental logins and people trying 5 times to guess my password via birthday and name combinations.

Some form of two-factor auth seems to be the only safe bet nowadays.

 

[lothar]

is completely out of hand.

I mean, it's always been ridiculous: change it every few months, 8+ characters, letter and numbers, etc...but now it's just STUPID. Was just made to update my account for commenting on a blog (not transferring millions of dollars, and not passing nuclear launch codes) and it required 20 characters exactly, or upper, lower, number, and special characters 8 or more long.

I promptly deleted my entire account, as I did with NCSoft, previous jobs, and every other place that makes such ludicrous requirements.

NEWSFLASH: YOUR PASSWORDS DO NOT FUCKING MATTER IN THE LEAST!!!

Anyone with half a brain can hack your accounts no matter what you do. Having a password at all is about as useful as putting the loaded gun on the top shelf instead of leaving it on the coffee table. So KNOCK IT OFF people!

/rant

http://www.safe-in-cloud.com/en/
Problem solved.

 

[mmntech]

Word dictionary attack should make that one easy.

Yeah, ever since that comic came out and everyone started using random words.

Unfortunately, passwords aren't secure at all anymore. Gotten to the point where we either need to ditch them or make multiple step authentication more widespread.

 

[sdifox]

lulz NSA was able to monitor communication of the whole country of France for a month. I doubt any password we use is safe.

 

[ultimatebob]

It wouldn't matter. Three months from now the requirement will be 50 characters, in 7 different languages, plus a DNA strand. There is no force in the universe greater than collective stupidity.

... and some bozo will still be saving a copy of them in cleartext somewhere, just waiting to be hacked.

 

[ViviTheMage]

get rid of character/case sense requirements, and require at least 16 characters...that would be AOK with me.

 

[DrPizza]

Word dictionary attack should make that one easy.

You mean ''correct battery staple horse''? That wouldn't be easy to crack using a dictionary attack.

 

[Train]

You mean ''correct battery staple horse''? That wouldn't be easy to crack using a dictionary attack.

You sure? According to oxford dictionary, there are 750,000 English words.

What's 4^750000?

Even being more realistic, say only 100k words to choose from, that's more than my calculator can handle.

EDIT:

Sorry, just read that you said it WOULDN'T be easy, which IMO, is true.

 

[DrPizza]

Everyone should read this article. Correct battery horse staple will go down quite quickly under these methods. Sure, it will take a long time to brute force, but these attacks don't use brute force. Dictionaries with substitution rules, password lists, etc all cut down the time it takes dramatically.

To the poster who uses the 4-letter algorithm, I do something similar but it won't really help either. Basically, the article states that if the algorithm is simple enough for you to remember, then it exists as a rule in some password cracking algorithm somewhere, and a computer can run it faster than you can.

With security/recovery questions being the stupidly easy way to get passwords nowadays, I am basically resigned to the notion that my passwords exist just to keep out accidental logins and people trying 5 times to guess my password via birthday and name combinations.

Perhaps, I should have been more specific above. "correct horse battery staple" would be easy because that specific set of four words is now a part of a dictionary attack. But, four other random words is not. E.g., until someone scrapes this following phrase from this post, it would not be vulnerable (if I didn't post it, it would be immune to the attack methods mentioned in that article): Anandtech.tetracyclinebinomialdingleberries Four words, a specific password for this site, ( see how it could be modified for other sites?). Toss on another random word, and it becomes less vulnerable by more orders of magnitude. So, if I even told you that I picked four random words from the dictionary, assuming a working vocabulary of 60000 words, that's 12960000000000000000 possible combinations. Toss in a random punctuation and or capitalization, and for the time being, it's safe. What isn't safe is a four word combination that has appeared in print.

 

[Engineer]

It wouldn't matter. Three months from now the requirement will be 50 characters, in 7 different languages, plus a DNA strand. There is no force in the universe greater than collective stupidity.

I agree with this. It's completely insane at the stupid requirements these days.

 

[Red Squirrel]

Another trend I hate is secret questions. those actually reduce security because someone can just find out the answer through social engineering. I would not considered my mother's maiden name or the school I went to to be a closely guarded secret. I usually put BS in there because they've always been used only if you forget your password (which is where the security issue is) but I see a lot of places that will randomly ask these questions after you put in your password. That forces you to put something you can remember, but that someone wont be able to find out in case someone tries to use the lost password feature. Oddly enough it seems to be banks that do this more than anything.

 

[Train]

Another trend I hate is secret questions. those actually reduce security because someone can just find out the answer through social engineering. I would not considered my mother's maiden name or the school I went to to be a closely guarded secret. I usually put BS in there because they've always been used only if you forget your password (which is where the security issue is) but I see a lot of places that will randomly ask these questions after you put in your password. That forces you to put something you can remember, but that someone wont be able to find out in case someone tries to use the lost password feature. Oddly enough it seems to be banks that do this more than anything.

A conversation I had recently with Chase:

Rep: What's your mothers maiden name?
Me: donkey snowman pickle stolen 426
Rep: wat
Me: trust me, I'm from the internets.
Rep: typing....
Rep: well I'll be damned, what can I do for you Mr. Train?

 

[darkewaffle]

You mean ''correct battery staple horse''? That wouldn't be easy to crack using a dictionary attack.

I'm inclined to agree. Most dictionary based attacks are intentionally uncomplex, at least to start. And added complexity is usually created through the use of a hybrid attack rather than stringing more words together.

Any combination of those two words would be broken quickly, and the full password could be cracked by using a list with random combinations of four words (as opposed to two, which is most common), but that is going to be an absolutely tremendous amount of wasted time and computational power because of the exponential increase in the number of guesses necessary. Ultimately I think it would depend on the size of the word list but that's a double edged sword: more words gives you a more complete list of guesses but also means that added complexity will take that much longer to include, whereas a shorter list of course means you might miss something.

The problem with passphrases is not that they are phrases or that they can be dictionary attacked, but rather the fact that they already 'exist' so often through in existing literature, documentation, lyrics, logs, etc. For instance "correctbatterystaplehorse" would likely not be cracked by guessing every combination of [word1][word2][word3][word4] but simply the known phrase "correctbatterystaplehorse" because it is now part of some log or lexicon somewhere.

What's different about the passcodes cracked in this article is that their raw materials were assembled from phrases rather than single words. While a computer eventually might have combined the words "crotalus" and "atrox" to guess one of the passwords Dustin decoded, it probably would have taken years of time-consuming combinator attacks before that winning pair came up in the roulette wheel.

 

[KlokWyze]

http://www.safe-in-cloud.com/en/
Problem solved.

so many of these coming out. i just discovered 2 in this thread.

LastPass is the best I've encountered, but it's used @ the browser level. There is another that is used @ the OS level.... keepass I think. That could be interpreted differently.... :biggrin: