A Really Good Article on How Easy it Is to Crack Passwords
1–10 of 76 posts
Re: A Really Good Article on How Easy it Is to Crack Passwords
#2Remember, security against cracking is a combination of password strength and key derivation function strength. Nothing will save you if your password is "password". Not much will save you if your password is hashed with MD5.
But scrypt can be over 100,000,000 time stronger than MD5 -- so if you're using scrypt you can afford to use a password which is 100,000,000 times weaker. "jdtwbv" hashed using scrypt is stronger than "H.*W8Jz&r3" hashed using MD5.
Re: A Really Good Article on How Easy it Is to Crack Passwords
#3Remember, security against cracking is a combination of password strength and key derivation function strength . Nothing will save you if your password is "password". Not much will save you if your password is hashed with MD5. But scrypt can be over 100,000,000 time stronger than MD5 -- so if you're using scrypt you can afford to use a password which is 100,000,000 times weaker. "jdtwbv" hashed using scrypt is strong…
Just use bcrypt :-p
Re: A Really Good Article on How Easy it Is to Crack Passwords
#4> "This is an answer to the batteryhorsestaple thing."
Steube misunderstands the xkcd comic [1]. There's a really good comment which explains it: "It could be argued that Randall's example of 4 words is too short -- and indeed, for some applications, it is. However for a typical dictionary size, and genuinely random selection, it is massively stronger than "typical" passwords and in fact easily adequte to defeat the above-mentioned attacks." [2]
Emphasis on "genuinely random selection."
[2] http://www.schneier.com/blog/archives/2013/06/a_really_good_...
Re: A Really Good Article on How Easy it Is to Crack Passwords
#5I like schemes that have an explicit input of n random bits (or where you can at least have a good estimate on the entropy.) With the Schneier Scheme I can not be sure of the actual entropy of my password. Maybe my brain only generates a relatively small set of sentences which can be reverse-engineered from my comments on HN? :-)
A good algorithm would take n bits and map them uniquely to a set of strings that are easy to remember for a human. The apg utility does something like that.
Re: A Really Good Article on How Easy it Is to Crack Passwords
#6> "This is an answer to the batteryhorsestaple thing." Steube misunderstands the xkcd comic [1]. There's a really good comment which explains it: "It could be argued that Randall's example of 4 words is too short -- and indeed, for some applications, it is. However for a typical dictionary size, and genuinely random selection, it is massively stronger than "typical" passwords and in fact easily adequte to defeat the…
What password length would you need to get away with a plain-old grammatical english sentence (i.e. very much non-random selection)?
For example: "and in the swept plains of winter's vale, our hero did beseech the emperor to send for his forces" -- what would be the difficulty in cracking that, given that this isn't a quote from a book or anything, but just a sentence that popped into my mind and seems easy enough to remember?
Re: A Really Good Article on How Easy it Is to Crack Passwords
#7Remember, security against cracking is a combination of password strength and key derivation function strength . Nothing will save you if your password is "password". Not much will save you if your password is hashed with MD5. But scrypt can be over 100,000,000 time stronger than MD5 -- so if you're using scrypt you can afford to use a password which is 100,000,000 times weaker. "jdtwbv" hashed using scrypt is strong…
Just use bcrypt :-p
bcrypt is not bad and you're definitely better off with that than with MD5, but scrypt performs better for these sort of things. There was an article on HN a week or so ago about this.
Re: A Really Good Article on How Easy it Is to Crack Passwords
#8> "This is an answer to the batteryhorsestaple thing." Steube misunderstands the xkcd comic [1]. There's a really good comment which explains it: "It could be argued that Randall's example of 4 words is too short -- and indeed, for some applications, it is. However for a typical dictionary size, and genuinely random selection, it is massively stronger than "typical" passwords and in fact easily adequte to defeat the…
What password length would you need to get away with a plain-old grammatical english sentence (i.e. very much non-random selection)? For example: "and in the swept plains of winter's vale, our hero did beseech the emperor to send for his forces" -- what would be the difficulty in cracking that, given that this isn't a quote from a book or anything, but just a sentence that popped into my mind and seems easy enough to…
Shannon did an experiment that found the entropy of English text is about 1.6 bits per character. This is probably a high estimate, since the kinds of sentences you might think up for a password probably have lower entropy than if you used a source of random bits to generate valid sentences.
Re: A Really Good Article on How Easy it Is to Crack Passwords
#9Passwords are broken and I really wish we would all move away from them. Persona is a nice idea with regards to privacy and control, but it's still a password that you need to remember, which can be cracked. Also, people generally don't use strong passwords.
What irks me is that every OS in use today has support for strong cryptography and browser vendors could easily integrate that. We would no longer register for a website, we would simply upload our "Online Identity" or whatever we called it. This of course is just an id_rsa.pub with maybe name and email in the comment. The remote site stores the public key and the browser authenticates using the private key, stored securely in the keychain.
This has the potential to be invisible to users, and thus used by default, and highly secure since the local keychain can generate incredibly strong keys, all behind the scenes.
Re: A Really Good Article on How Easy it Is to Crack Passwords
#10Passwords should be a thing of the past. It gives the users an illusion of security.