241–250 of 299 posts
Funny comic as usual, but the 20 years thing is probably invalid. How long would cracking tr0ub4dor&3 on a 486 take? Also I remember some systems didn't allow pass phrases back then. Windows NT in particular had a max password limit of 14 characters, iirc.
This scheme could be easily guessed by a dictionary attack that simply ran through combinations of dictionary words instead of individual characters. If this became a popular scheme, the whole entropy argument goes out the door. It only has more entropy if we compare the two schemes on a character-by-character basis (~10 vs. ~25). Of course the longer string will appear to have more entropy. But if a password guesser…
How does one calculate password entropy? I deduced this one: entropy = log2(symbols^chars) But using 63 symbols ([a-zA-Z0-9&]) I get 65 bits for Tr0ub4d0r&3, not 28.
Earlier quoted context omitted.
May I ask how did you find out about that study? It sounds very interesting. I've got to try it sometime :).
You mean the statistics demonstration? I'm sure I've seen it in several places. I know of two tricks for detecting the students. The first is to look for six or seven heads or tails in a row. Over a hundred tosses, a coin will probably do that, but humans "being random" won't. The other is to look at the page as a sequence of "HHH" and "TT" strings and estimate how many there are. A coin, of course, changes from head…
So here's what I got: figure I have a bias to switch keys. That means that 01 and 10 are more common than 11 and 00. So what I need to do is group 01 with 00, and 10 with 11. What I do is generate twice as many bits as I need, treat the string as a sequence of two-bit pairs, and reduce each one to its first bit. That looks like this: 01011110000010111000010011111011111111000000111010110001111000111100111100001100011010011101
Gets you past the litmus test, but looks like it goes too far the other way? Hard for me to tell, actually.
Another thing would be something like a sequential xor of each bit in triples (i.e. 010 -> (0 ^ 1) ^ 0 = 1), which segments triples across probability like so:
- + + -
000 001 010 011 100 101 110 111
0 1 1 0 1 0 0 1
I don't know if it adds much more (apparent) entropy, though.
Data:
011101101010100100010100100010111001010100110000101011101101110
0 1 0 1 1 1 1 0 0 0 0 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1 1 1 1 0 1
0 0 0 1 1 0 1 1 0 1 1 0 1 1 0 0 0 0 0 0 1
111010111010100101000101011110100011011011010001111011110101001
1 1 1 1 1 1 1 0 0 0 0 0 0 1 1 1 0 1 0 1 1 0 0 0 1 1 1 1 0 0 0
1 1 1 1 1 0 0 1 0 1 1 0 0 0 1 0 1 0 1 0 0
101110100101101010110101010001101101010010110111010110101001110
1 1 1 1 0 0 1 1 1 1 0 0 0 0 0 1 1 0 0 0 1 1 0 1 0 0 1 1 1 0 1
0 0 1 0 0 1 0 0 1 1 0 0 1 1 0 1 1 0 0 1 0Earlier quoted context omitted.
I've started using song lyrics when given the option of an extra-long password. I can get a very long string with little effort, and it's trivial to remember. The best part is that any automated attack would have to deal with ringtone popups.
Be aware that adding to the length simply by taking more of the lyrics adds very little entropy. If you're trying "Oh say can you see" then it doesn't take a lot of extra bits also to try "Oh say can you see by the dawn's early light what so proudly we hailed at the twilight's last gleaming". Similarly, extended passages of text -- even if they don't come from a restricted corpus like that of song lyrics -- have less…
Earlier quoted context omitted.
>. How is this an improvement? I now have to remember a song lyric, and some set of random manipulations of that song lyric. I've used that trick for passwords before, and it was a hassle. But that doesn't even matter— unless you're choosing the manipulations randomly (which is a contradiction in terms) you're falling right back into the exact damn trap the comic was about! You've added ! at the end, replaced s with…
It's fairly easy for me to remember those manipulations. But you're right insofar that this would probably be both safer and easier to remember: Smells like teen spirit, and I like that plenty mucho! I'm too lazy to do the math on it, perhaps you can help out? Edit: It's a little annoying to collect these downvotes from people who either haven't done the math themselves or are too lazy to explain their advanced attac…
I guess we'll find out when passphrases become common :)
A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…
i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need. let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types…
It's hard for humans to remember meaningless conjunctions of symbols, so we think they are hard to guess; so we err on the side of making them too short. Contrariwise, we think a sequence of just four words couldn't possibly be hard to guess because it's so easy to remember, but it's only easy to remember because we can use the meanings of the words to form an idea or image, something our brains are built for (unlike strings of meaningless characters).
This is why the word technique is better: it corresponds better with how we remember, while reducing two other risks: the risk of losing your password - non-trivial - and choosing too short a password.
I prefer using a program like Password Safe ( http://passwordsafe.sourceforge.net/ ), and use a safe password that's a long sentence (with punctuation). Then I can use arbitrarily long and complex passwords for all my accounts, and not have to worry about memorizing them individually. The password safe can even be synced across computers using Dropbox.
I prefer KeePass simply because it's got implementations on multiple OSs, as does Dropbox (to sync the password database file). So I've got it on my iMac, Android phone, Windows laptop, and Windows work PC.
Does anyone else here not really remember their main password? Mine's all in muscle memory and I can't write it out unless I imagine a keyboard.