Increase your password security

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

A dictionary attack IS a brute force attack. Adding substitution variations really *doesn't* increase security. Dictionary attacks take relatively little time... adding in a variation where e's are 3's only makes it take twice as long. Considering the increases in processor ability, this becomes easier and easier to hack over time.

Yes, it's MORE secure... but that doesn't mean it's secure.

Keep in mind that I was a codebreaker 20 years ago... ;)

 

More on long pass phrases vs. complex passwords, from Microsoft (bolding added for emphasis):

Certainly longer is better... but it's just as important to intelligently create those passwords. Use what you will... I simply give the warning that a long passphrase, with or without leetspeak, isn't necessarily the answer.

 

yea sorry I thought I typed progressive

morse code guru

 

Actually, I wanted to learn it, but never did. I worked mostly with the voice intercept guys, not the "ditty-bops" (Morse intercept guys). My job involved frequency pattern cracking and codebreaking/cryptanalysis.

 

And keep in mind strong passwords are almost useless if the password recovery mechanism requires only access to your email account, or knowing your mother's maiden name.

While I agree with BM that passphrases have lower entropy per character, and poor passphrases are weak, it should be noted that the quote above from Microsoft is in some ways not very realistic, as the analysis is based on a passphrase with a basic 300 word dictionary. With a realistic vocabulary passphrases work very well and will be harder to brute force than an 8 character string.

As a little experiment I once had some techs at the office compose random strings for passwords. I then generated some (psuedo)random strings by computer, and mixed them together in a list. When we looked at the list is was obvious which strings were made by people. The point being that people are very poor at creating "random" strings, and brute force attacks will be optimized to take advantage of that.

Passphrases have the benefit of being easier to remember, and avoid the repeat pattern effect. Password amplifiers are also a possible solution, but every password scheme has drawbacks.

Spice_Weasel

 

I have my system set to maximum security if only it would destroy the people who may attempt to hack into it.

 

ha ha, I would trace any attempt on me any how then I'd get the old baseball bat out and pay them a visit

 

Simply trying to illustrate that any word can be dictionaried... even strings of words and/or leetspeaked translations. As long as I've helped people to realize what is and isn't secure, then my mission is complete, regardless of which method is chosen.

Personally, I'm a fan of acronymized pass phrases, provided they're at least 8 characters in length.

 

Agreed, too many people think "p455w0rd" must be more secure then "password".

Me too - I find acronymized pass phrases passwords a good compromise, easy to remember, and not as susceptible to attack as a short pass phrase. Full (long) pass phrases I usually use for something like a truecypt volume on a laptop.

Spice Weasel