Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Strong is Your Password?

intel.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: How Strong is Your Password?

#51

Post by ay »

Zikes wrote: post #38

> Step 3: Diversify your social passwords for added security > "My 1st Password!: Twitr" > "My 1st Password!: Fb" > "My 1st Password!: Redd" This is a terrible technique, because it's only marginally better than using the exact same password everywhere. It shares the same weakness in that as soon as your password is compromised in one place, it's as good as compromised everywhere else.

A simple way to make this a bit harder:

stty -echo; echo `read | sha1sum` LittleBitOfSalt | sha1sum | cut -c 1-40 | pbcopy; stty echo

Then paste whatever ends up in the clipboard as your password.

pbcopy is MacOS X specific I think, but IIRC there was similar way to shove stuff into clipboard on linux. Else you end up with (1) password on the screen (2) immense pain typing 40 senseless hex chars :-)

Both Intel's contest and the test at http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htm... mentioned elsewhere in this thread seem to be relatively happy with the result..

The fully random passwords with the password manager are probably better though...

Re: How Strong is Your Password?

#52

Post by liber8 »

DanielStraight wrote: post #14
joelg236 wrote: post #12

Earlier quoted context omitted.

http://xkcd.com/936/

Which inexplicably gets 182,598,077,247 years. This thing clearly does not understand how to judge passphrases. For comparison, here is the best password checker I've found: http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htm...

Perhaps this is a stupid question, but your password checker claims "vertex112" would take 3 months to crack, but "vertex1123" only 3 days to crack. Why would adding an additional, non-repeating number make it easier to crack?

Re: How Strong is Your Password?

#54

Post by tetrad »

Piskvorrr wrote: post #49
tetrad wrote: post #31

Their advice for diversifying your passwords is not very good. If you are using the same password stem with a suffix determined by the site name, as "m1p.5AsGs9LXo_HN" for HackerNews "m1p.5AsGs9LXo_RandomForum" for some random forum "m1p.5AsGs9LXo_WF" for Wells Fargo and the random forum's database gets popped, how secure do you think your Wells Fargo password "m1p.5AsGs9LXo_WF" is? Less than 12486848 years. That goe…

That's the one thing which always leaves me speechless: what is the purpose of having an upper bound on password length? To me, it always feels like they're putting up a humongous, blinking sign proclaiming "Proudly storing your passwords in plaintext since 1991!" (Most notable offender, last time I checked: Skype)

It doesn't necessarily mean that they're storing it plaintext (ie it could simply be a front-end input validation). But in any case it doesn't inspire confidence that they're following best practices.

Re: How Strong is Your Password?

#56

Post by Piskvorrr »

tetrad wrote: post #54
Piskvorrr wrote: post #49

Earlier quoted context omitted.

That's the one thing which always leaves me speechless: what is the purpose of having an upper bound on password length? To me, it always feels like they're putting up a humongous, blinking sign proclaiming "Proudly storing your passwords in plaintext since 1991!" (Most notable offender, last time I checked: Skype)

It doesn't necessarily mean that they're storing it plaintext (ie it could simply be a front-end input validation). But in any case it doesn't inspire confidence that they're following best practices.

I'm somewhat skeptical of "we have a validation rule here, but it doesn't validate against any actual requirement, we just threw it in for the heck of it [image of dog piloting an airplane]." Even the bizarre "well, we have a CHAR(20) for the password, so we can't save anything longer" sounds saner than that ;)

Re: How Strong is Your Password?

#57

Post by mentat »

thedufer wrote: post #22

The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided b…

Wonder how many filtering proxies got triggered by the NSFW words in that list. Would be funny if Intel.com got temporarily black listed.

Re: How Strong is Your Password?

#58

Post by user24 »

dllthomas wrote: post #23
user24 wrote: post #3

Yes, lets teach users to type their passwords into "checking" tools. Great. edit: on the plus side, "CONGRATULATIONS! It would take about 2546476408336 years to crack your password." (I typed in a password that was roughly equivalent to a very secure and memorable one I memorised but have never found a use for. It's a correcthorsebatterystaple style password.)

> correcthorsebatterystaple In general, including the spaces is a better idea, because collisions.

I don't understand

Re: How Strong is Your Password?

#59

Post by marshray »

Piskvorrr wrote: post #49
tetrad wrote: post #31

Their advice for diversifying your passwords is not very good. If you are using the same password stem with a suffix determined by the site name, as "m1p.5AsGs9LXo_HN" for HackerNews "m1p.5AsGs9LXo_RandomForum" for some random forum "m1p.5AsGs9LXo_WF" for Wells Fargo and the random forum's database gets popped, how secure do you think your Wells Fargo password "m1p.5AsGs9LXo_WF" is? Less than 12486848 years. That goe…

That's the one thing which always leaves me speechless: what is the purpose of having an upper bound on password length? To me, it always feels like they're putting up a humongous, blinking sign proclaiming "Proudly storing your passwords in plaintext since 1991!" (Most notable offender, last time I checked: Skype)

In practice, there will be some part of the system that breaks first when a password or any other field tries to grow infinitely long. Having a defined upper bound from the beginning of the design means you have a testable requirement.

That said, there's no excuse for setting the upper bound so low that any human ever gets their actual choice for a password rejected.

Re: How Strong is Your Password?

#60

Post by dllthomas »

user24 wrote: post #58
dllthomas wrote: post #23

Earlier quoted context omitted.

> correcthorsebatterystaple In general, including the spaces is a better idea, because collisions.

I don't understand

If you want to maximize entropy, you want to avoid collisions.

Say we're taking strings of one or two words, picked randomly. With spaces, there's an equal chance of any string that can be generated. Without spaces, "therapist" has twice the chance of the typical string, which is some information an attacker could exploit.

Post reply on HN