Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Strong is Your Password?

intel.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: How Strong is Your Password?

#41

Post by JoeKM »

cypherpunks01 wrote: post #33

I use the Stanford PwdHash extension, anyone else? I think it's a solid scheme for using unique passwords on every site, based on just having to remember at minimum one input password. http://pwdhash.com

I used to do this, but there are still so many annoying websites that require certain characters or maximum length, or other patterns, to your password. I would use a PwdHash for some websites and not for other websites, and then have to remember which sites I used PwdHash and which I didn't.

I finally settled on 1Password for the iPhone. I don't remember any of my passwords. I unlock 1Password, find and reveal the password, and type it in. This allows me to have really complex and long passwords. I always have my phone on me, as I use 2-step authentication for every service that provides it. In the rare event I forget a password, I still have email fallback recovery.

Re: How Strong is Your Password?

#42

Post by jerf »

khafra wrote: post #40
thedufer wrote: post #22

The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided b…

Thanks for the overview. It'd be nice if they could make a password strength checker that got the exact strength instead of an estimate, that would be cool (because actually building a hypercomputer is impressive).

There isn't really an "exact strength"; a password cracker exhaustively trying all permutations of letters and numbers will never find your password with !, a password cracker exhaustively trying all combinations of letters and numbers will take a very long to find "electroencephalograph" whereas a dictionary attack will find it very quickly if that's in the dictionary, etc. It depends on the order the cracker is trying the passwords in.

Re: How Strong is Your Password?

#44

Post by thedufer »

khafra wrote: post #40
thedufer wrote: post #22

The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided b…

Thanks for the overview. It'd be nice if they could make a password strength checker that got the exact strength instead of an estimate, that would be cool (because actually building a hypercomputer is impressive).

"exact strength" depends on the algorithm being used. If you're just checking dictionary words, some passwords would be really weak; if you're exhaustively checking every combination of characters, the same passwords would be pretty strong, and a different set would be very weak.

Re: How Strong is Your Password?

#46

Post by jholman »

Zikes wrote: post #38

> Step 3: Diversify your social passwords for added security > "My 1st Password!: Twitr" > "My 1st Password!: Fb" > "My 1st Password!: Redd" This is a terrible technique, because it's only marginally better than using the exact same password everywhere. It shares the same weakness in that as soon as your password is compromised in one place, it's as good as compromised everywhere else.

Yes and no.

If someone is attacking you personally, yes.

If someone attacks a group that includes you, breaks one of your passwords, and posts a dump on the internet, yes.

But if someone gets some password database, bruteforces all the passwords under 20 characters, and now has a username-to-password map with a million entries.... you're probably safe from that attacker using your username/password on other services. So I'd say that it's better than "marginal".

So it depends on what attack scenario you're defending against. Which is true for all safety judgements.

Re: How Strong is Your Password?

#48

Post by JoshuaDavid »

recycleme wrote: post #27
DanielStraight wrote: post #7

There are clearly some problems here. "bacon giraffe coffee paper head": 2 weeks "coffee banana tourist nose": 15368 years Or even worse: "i like salt": 18 years "i like pepper": 9 hours

Let's add a few more for fun. "salt tastes ok": 324658 years "intel password sweepstakes": 8441109 years "dictionary attack": 390 years

> Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

CONGRATULATIONS! It would take about Infinity years to crack your password.

Re: How Strong is Your Password?

#49

Post by Piskvorrr »

tetrad wrote: post #31

Their advice for diversifying your passwords is not very good. If you are using the same password stem with a suffix determined by the site name, as "m1p.5AsGs9LXo_HN" for HackerNews "m1p.5AsGs9LXo_RandomForum" for some random forum "m1p.5AsGs9LXo_WF" for Wells Fargo and the random forum's database gets popped, how secure do you think your Wells Fargo password "m1p.5AsGs9LXo_WF" is? Less than 12486848 years. That goe…

That's the one thing which always leaves me speechless: what is the purpose of having an upper bound on password length?

To me, it always feels like they're putting up a humongous, blinking sign proclaiming "Proudly storing your passwords in plaintext since 1991!" (Most notable offender, last time I checked: Skype)

Re: How Strong is Your Password?

#50

Post by marshray »

jholman wrote: post #46
Zikes wrote: post #38

> Step 3: Diversify your social passwords for added security > "My 1st Password!: Twitr" > "My 1st Password!: Fb" > "My 1st Password!: Redd" This is a terrible technique, because it's only marginally better than using the exact same password everywhere. It shares the same weakness in that as soon as your password is compromised in one place, it's as good as compromised everywhere else.

Yes and no. If someone is attacking you personally, yes. If someone attacks a group that includes you, breaks one of your passwords, and posts a dump on the internet, yes. But if someone gets some password database, bruteforces all the passwords under 20 characters, and now has a username-to-password map with a million entries.... you're probably safe from that attacker using your username/password on other services.…

In Soviet Russia, the attacker gets chosen by you!
Post reply on HN