61–70 of 76 posts
' Also included in the list: "all of the lights" (yes, spaces are allowed on many sites), "i hate hackers," "allineedislove," "ilovemySister31," "iloveyousomuch," "Philippians4:13," "Philippians4:6-7," and "qeadzcwrsfxv1331." "gonefishing1125" was another password Steube saw appear on his computer screen. Seconds after it was cracked, he noted, "You won't ever find it using brute force." ' If you won't ever find "gon…
Passwords are broken and I really wish we would all move away from them. Persona is a nice idea with regards to privacy and control, but it's still a password that you need to remember, which can be cracked. Also, people generally don't use strong passwords. What irks me is that every OS in use today has support for strong cryptography and browser vendors could easily integrate that. We would no longer register for a…
Earlier quoted context omitted.
""jdtwbv" hashed using scrypt is stronger than "H.*W8Jz&r3" hashed using MD5" Is it? I'm not sure. for the first one you're using lowercase letters (and digits, I'm giving you that 'free') For the first one we have 36^6 For the second one (all printables) 100^9 Relation between them: ~ 459,393,658. If you're saying scrypt is 100M times better, in this case the second one is safer And the relation is important but les…
People have built huge rainbow tables of MD5 hashes. I don't really keep up with that game (like WoW, it seems like a fun game, but only if you are willing to put in a lot of your time), but I think the current limit is somewhere around 8 or 9 characters if you are pulling from all printables, meaning that "H.*W8Jz&r3" with MD5 is probably not breakable right now. Take off two characters, or wait 3 years, and it prob…
Earlier quoted context omitted.
People have built huge rainbow tables of MD5 hashes. I don't really keep up with that game (like WoW, it seems like a fun game, but only if you are willing to put in a lot of your time), but I think the current limit is somewhere around 8 or 9 characters if you are pulling from all printables, meaning that "H.*W8Jz&r3" with MD5 is probably not breakable right now. Take off two characters, or wait 3 years, and it prob…
My understanding, and I'm sure that someone else will correct me, is that with MD5 rainbow tables it's not so much that someone will get your password as they will get something that hashes to the same value. More than likely this will be your password, but sometimes not. The point is that it doesn't matter if your password is 25 characters long.. if there's a 5 character password that hashes to the same value they c…
In fact, collisions on short passwords are harder than collisions on long passwords. The space of all MD5 outputs is way bigger than the space of 12-character passwords.
Earlier quoted context omitted.
My God, are you going to type all of that or will you need a script to do it for you. Watch out for those touch-screen thingies people are touting around.
http://keepass.info/ Some things you don't always need to use from those touch-screen thingies
Earlier quoted context omitted.
Where are you guys getting this? All I read was this: > Steube was able to crack "momof3g8kids" because he had "momof3g" in his 111 million dict and "8kids" in a smaller dict. > "The combinator attack got it! It's cool," he said. Then referring to the oft-cited xkcd comic, he added: "This is an answer to the batteryhorsestaple thing." It sounds to me like he's combining words randomly, not "exploiting common human be…
He found a password by 2 words randomly from two dictionaries of different sizes, so he only had m * n combinations to choose from, and his n is a lot smaller than m. Whereas the xkcd approach is more like m * m * m * m. In other words, exponentiation > multiplication.
Earlier quoted context omitted.
What password length would you need to get away with a plain-old grammatical english sentence (i.e. very much non-random selection)? For example: "and in the swept plains of winter's vale, our hero did beseech the emperor to send for his forces" -- what would be the difficulty in cracking that, given that this isn't a quote from a book or anything, but just a sentence that popped into my mind and seems easy enough to…
My God, are you going to type all of that or will you need a script to do it for you. Watch out for those touch-screen thingies people are touting around.
One benefit of being a indian language speaker (or other language not in hackers dictionary) is we can easily choose reasonably secure passwords that are remember-able by simply using native language phrases (combined with numbers and mixed caps)
Earlier quoted context omitted.
Yes you are right that it is not 'true' two-factor authentication. It would certainly be more secure if all my users were able and willing to use something like Google Authenticator. However, I suspect that most of my users (who are not especially computer literate) would prefer the simplicity of writing down 4 words over having to install and configure an two-factor app on their phone. You say, "it's not much more d…
Why not just require your users to set a 4-word passphrase as their password? You'll capture more variations than you would working from a fixed 5,000 word dictionary, and your users can still choose to write the words down if they want--or they can use the password management features of their browsers if they want. Plus it would be more simple to build and maintain, which is a plus when it comes to security.
If the system randomly chooses the four words then you force the user to exchange convenience for security.
Earlier quoted context omitted.
And how do you access your identity from a device that isn't your own? I'm 100% with you, it would be a major step forward - but it's too inflexible for Joe & Jane.
and also it kinda destroys the ubiquity of the service. you have to admit, the ability to access your account from any device anywhere is pretty cool (and very critical in some cases)
In Denmark we have a public system called "NemID". It is a 2-factor authentication, which relies on a card with one-time codes, or eventually, a physical key-generator. It is used to anything related to Internet Banking or access to the public services on the internet, such as application for university, change in tax return, and the like. Unless you can incorporate such a system, which ensure that most uses already have the needed physical token, I not convinced you can pull it off.