How Strong is Your Password? • Hacker News Board

Re: How Strong is Your Password?

#31

Post by tetrad » Wed, May 08, 2013, 5:39 PM UTC

Their advice for diversifying your passwords is not very good. If you are using the same password stem with a suffix determined by the site name, as

"m1p.5AsGs9LXo_HN" for HackerNews "m1p.5AsGs9LXo_RandomForum" for some random forum "m1p.5AsGs9LXo_WF" for Wells Fargo

and the random forum's database gets popped, how secure do you think your Wells Fargo password "m1p.5AsGs9LXo_WF" is? Less than 12486848 years. That goes from the realm of password cracking to some guy typing out all the abbreviations he can think of for Reddit or Twitter.

In case you're wondering, Wells Fargo will not accept "m1p.5AsGs9LXo_WF" as a password - too long!

Re: How Strong is Your Password?

#32

Post by marshray » Wed, May 08, 2013, 5:50 PM UTC

cperciva wrote: post #24

They seem to be making an assumption of 1.67 * 10^11 hashes per second. Based on decade-old ASIC processes, this is $100 worth of silicon if you're using MD5 as a key derivation function (using SHA1 or SHA256 or SHA512 would be no more than 2-3 times larger). On the other hand, if you're using MD5 CRYPT, they're assuming $100,000 worth of ASICs. If you're using PBKDF2-SHA256 with standard "login credentials" paramete…

Well there's another way to look at it too: the strength of any password-based credential system relies upon the user refusing to give the password to unauthorized parties. The unfortunate consequence of this is that the user must authenticate the system (and verify the security of the connection between) before entering their password.

Intel has brilliantly demonstrated a social engineering/phishing attack here. "A street game" on New Yorkers, of all people! http://www.intel.com/content/www/us/en/security/passwordwin-...

But the strength estimates they give are far too high: What is the strength of a password which a user is willing to type into a non-https website or computer on the street?

Very low.

Re: How Strong is Your Password?

#33

Post by cypherpunks01 » Wed, May 08, 2013, 5:52 PM UTC

I use the Stanford PwdHash extension, anyone else?

I think it's a solid scheme for using unique passwords on every site, based on just having to remember at minimum one input password.

http://pwdhash.com

Re: How Strong is Your Password?

#34

Post by jstalin » Wed, May 08, 2013, 5:53 PM UTC

CONGRATULATIONS! It would take about 2.956558857989926e+39 years to crack your password.

Bueno.

Re: How Strong is Your Password?

#35

Post by kintamanimatt » Wed, May 08, 2013, 5:54 PM UTC

mountaineer wrote: post #6

Looks like a great target for phishers to knock off.

Not really. You'd need a second credential, i.e. a username or email address. Not that many people would be dumb enough to enter their username and password to "check" how secure they are, would they?

I think we trust it primarily because it's client side code and on Intel's site.

Re: How Strong is Your Password?

#36

Post by isaacaggrey » Wed, May 08, 2013, 5:56 PM UTC

DanielStraight wrote: post #14

joelg236 wrote: post #12

Earlier quoted context omitted.

http://xkcd.com/936/

Which inexplicably gets 182,598,077,247 years. This thing clearly does not understand how to judge passphrases. For comparison, here is the best password checker I've found: http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htm...

FWIW, repeating 'ab' 8 times as a password gives 'centuries' worth of crack time (i.e., 'abababababababab').

(I am very impressed by the password checker though; it's difficult to cover all scenarios)

Re: How Strong is Your Password?

#37

Post by marcosdumay » Wed, May 08, 2013, 5:58 PM UTC

jstalin wrote: post #34

CONGRATULATIONS! It would take about 2.956558857989926e+39 years to crack your password. Bueno.

Too bad you just gave it to Intel, and over plain text.

Re: How Strong is Your Password?

#38

Post by Zikes » Wed, May 08, 2013, 5:59 PM UTC

  > Step 3: Diversify your social passwords for added security 
  > "My 1st Password!: Twitr" 
  > "My 1st Password!: Fb" 
  > "My 1st Password!: Redd"

This is a terrible technique, because it's only marginally better than using the exact same password everywhere. It shares the same weakness in that as soon as your password is compromised in one place, it's as good as compromised everywhere else.

Re: How Strong is Your Password?

#39

Post by Bjoern » Wed, May 08, 2013, 6:01 PM UTC

Since the XKCD comic was already pasted here, instead some fun read.

"realistic password strength estimation" https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-s...

Re: How Strong is Your Password?

#40

Post by khafra » Wed, May 08, 2013, 6:02 PM UTC

thedufer wrote: post #22

The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided b…

Thanks for the overview. It'd be nice if they could make a password strength checker that got the exact strength instead of an estimate, that would be cool (because actually building a hypercomputer is impressive).