91–100 of 134 posts
I think it's interesting that "correcthorsebatterystapl" is more secure than "correcthorsebatterystaple". Makes sense, but it's amusing to see the time drop as you add letters.
If these sorts of 'strength checkers' become ubiquitous across enough places, I wonder how much value there will be in using reverse-engineered (most of these are in JS for UX latency reasons, right?) models of their strength testing as another parameter to your brute-forcing module. Then you can automatically skip any password you know is too simple, because the site won't have allowed the user to set it in the firs…
When the space of passwords denied by a rule is much, much smaller than the minimal search space, it doesn't matter all that much.
40 bits of entropy means 2^40; 20 bits means 2^20. 2^40 - 2^20 gives you something very, very close to 2^40 (39.9999986 bits of entropy.)
The real problem with humans is that passwords are still hard to remember for multiple services. Doesn't matter if you have a secure password and it's used everywhere. Likewise, if it's used with LastPass or 1Password style services, you face the problem of dealing with entering it. Though a desktop PC is fine for this, the best counter-examples are mobile devices. LastPass on mobile: 1. Use app that needs a password…
Earlier quoted context omitted.
Whenever I come across a site that refuses to let me sign up with a secure password, I either leave right away or send them a short mail first. There were times where I had to rely on password managers too, though. Banking sites are one common place ...
>Banking sites are one common place ... I can't tell you the number of times I've tried to explain to banks that 'security questions' are absolutely worthless, and that their 'secure password' policy is actually worse than no policy at all. One bank actually requires passwords to be between 6 and 8 characters in length, with at least one letter and one number and no special characters .
What the fuck.
Earlier quoted context omitted.
Guess = अनुमान , अंदाज़ , अटकल
I'd love to be able to use Unicode in general in my passwords. I've already mapped an interrobang on to my keyboard because I was using it so much I needed a key for it. But who would take it? (Since someone will ask, yes, there are some accounts I'm willing to limit myself to using one of my personal computers to access, or jumping through significant hoops to get there, like my bank account.)
Many sites won't accept my passwords (SHA1_Pass). They say that they are too long or have inappropriate chars or that they are not complex enough. Here's an example of inappropriate chars: UTP+NnhabgHKx6 So I make a different password and the sites say it is too weak as it has no special chars or uppercase chars: 5133fe36785a6e01cac7a68c9c111afff5bb4821 So I give up and type Password1 which is normally accepted.
My solution so far is: cat /dev/urandom|base64|tr -d '/+'|head -c10 Nearly every site supports a-z,A-Z,0-9 at 10 characters
$^$^$^i = crack time 3 months
$^$^$^z = crack time 5 years
Should the result vary so widely given the arguably minor variation?