This doesn't seem supper reliable
abcdefg123456! abcdefg!123456 abcdefg1!23456 = 5 seconds
a!bcdefg123456 = 1 week
Moving the ! supposedly increases the difficulty several orders of magnitude.
How Strong is Your Password?
21–30 of 60 posts
Re: How Strong is Your Password?
#22The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided by a "standard computing power" to get the number of hours it would take to crack.
This is about as rough as an approximation as you can get. For example, if your password contains dictionary words that aren't in their top passwords, it drastically overestimates the the difficulty of cracking it.
Type `"".hackability` in the console to see the code.
Re: How Strong is Your Password?
#23Yes, lets teach users to type their passwords into "checking" tools. Great. edit: on the plus side, "CONGRATULATIONS! It would take about 2546476408336 years to crack your password." (I typed in a password that was roughly equivalent to a very secure and memorable one I memorised but have never found a use for. It's a correcthorsebatterystaple style password.)
> correcthorsebatterystaple
In general, including the spaces is a better idea, because collisions.
Re: How Strong is Your Password?
#24They seem to be making an assumption of 1.67 * 10^11 hashes per second. Based on decade-old ASIC processes, this is $100 worth of silicon if you're using MD5 as a key derivation function (using SHA1 or SHA256 or SHA512 would be no more than 2-3 times larger).
On the other hand, if you're using MD5 CRYPT, they're assuming $100,000 worth of ASICs. If you're using PBKDF2-SHA256 with standard "login credentials" parameters (100 ms of CPU time), it's $14,000,000 worth of ASICs. bcrypt, $100,000,000. scrypt, $4,000,000,000. And if you're using scrypt with typical file-encryption parameters (5 s of CPU time), $15,000,000,000,000 worth of ASICs.
Moral of the story: Whether your password is strong enough depends as much on how it's stored as it does on the password itself.
Re: How Strong is Your Password?
#25This doesn't seem supper reliable abcdefg123456! abcdefg!123456 abcdefg1!23456 = 5 seconds a!bcdefg123456 = 1 week Moving the ! supposedly increases the difficulty several orders of magnitude.
That's because 123456 is a common password, as is abcdefg, so they're assuming that they will be in dictionaries and rainbow files, so they count them as a single letter.
Your first password, they interpret as aa! Your second, a!a Your third, a1!23456 Your fourth, a!bcdefga
Re: How Strong is Your Password?
#26There are clearly some problems here. "bacon giraffe coffee paper head": 2 weeks "coffee banana tourist nose": 15368 years Or even worse: "i like salt": 18 years "i like pepper": 9 hours
> "i like salt": 18 years
> "i like pepper": 9 hours
Well that's clearly because salted passwords are more secure.
Re: How Strong is Your Password?
#27There are clearly some problems here. "bacon giraffe coffee paper head": 2 weeks "coffee banana tourist nose": 15368 years Or even worse: "i like salt": 18 years "i like pepper": 9 hours
Let's add a few more for fun.
"salt tastes ok": 324658 years
"intel password sweepstakes": 8441109 years
"dictionary attack": 390 years
Re: How Strong is Your Password?
#28password = 0 seconds
password1 = 0 seconds
password12 = 0.0002 seconds
password123 = 0.0027 seconds
password1234 = 0.0272 seconds
Conclusion - password1234 is 100 times safer than password12. Thanks Intel! Changing my passwords now!
Re: How Strong is Your Password?
#29www.bash.org/?244321
Re: How Strong is Your Password?
#30I'm still against using passwords at all. In today's society it's completely unavoidable but instead of expecting people to go through the trouble of maintaining a different password for every site we should be trying to move websites in the direction of using tools like public key authentication and two-factor authentication. The future of internet security will be better if we make life easier for the end user.
And while public key authentication may seem difficult to implement server-side by doing such a thing you will never risk a database password leak again.