http:\/\/arstechnica.com\/security\/2013\/03\/how-i-became-a-password-cracker\/1\/<\/a>
\n================\u2026================
\nalthaz wrote:
\nThe best passwords are still those posited by XKCD (http:\/\/xkcd.com\/936\/) – four (two is next to
\nworthless and three is not that good) random words strung together.
\nReply:
\nActually, three or four random words with a numeral or special character inserted between each
\nword are much better (will defeat -every- lowercase brute force attack). Even just capitalising the
\nNth letter of each of your words gives a dramatic improvement in security.
\n“coRrectbaTteryhoRsestAple”
\nLonger is indeed always better, but the following are also good tips:
\n* numeral or special character inserted somewhere in the middle of the password. (It’s
\ncomputationally easy to check prepends and postpends, but still difficult to check every possible
\nPassword strenth 2 of 3 3\/26\/2013
\nposition.)
\n* ditto for capitalisation. The rules out there mean that “HorseStaple” is really no more secure
\nthan “horsestaple” (because it’s the most likely thing someone does to a two-word passphrase, and
\nthus only double the time to check), but “hoRsestAple” adds 5×6+2=33 permutations (if they
\nhave a rule to look for a single capitalized character in each word), which isn’t great, but is still
\nbetter than nothing.
\n* Even better, replace every Nth character with something completely different. “h&rses&aple” \/
\n“hQrsesQaple” \/ “h5rses5aple” … just be careful not to pick a substitution that turns a word into
\nanother word or accidentally emulates l33tsp34k.
\nAll that aside, the MOST important thing is, if you reuse passwords, reuse them wisely.
\n* Use unique passwords, as strong as you can stomach, for -every- account that involves access to
\nyour actual monetary resources (bank, paypal, amazon, etc)
\n* Ditto for any email account with password reset access to the above. THIS IS IMPORTANT!
\n* For sites where your online reputation or business would be harmed by a breakin, or where you
\nwould be seriously inconvenienced from a loss of access, use a unique password, but you don’t
\nneed it to be as strong.
\n* For generic forums and the like… try not to reuse if you can, and try to pick “good” passwords,
\nbut if the repercussions are low that it really isn’t too important. These definitely lend themselves
\ntowards the “ease of use” end of the scale, as there’s little for you to lose.
\nLast edited by Yobgod on 25 Mar 2013 02:46
\n================\u2026================
\nQuote:
\nOf course 16+ truly random characters is slightly harder to break, but it’s also impossible to
\nremember.
\nReply:
\nA 16 character truly random password is not “slightly harder to break”; it’s “computationally
\ninfeasible to break, even with massive parallelism, even with a really fast hashing function, for
\nyears to come”.
\nYour GPU may be able to do a billion hashes per second, and you may have a supercomputer
\nwith a thousand GPUs. Great. A trillion hashes per second. How much does that help you?
\nNot much.
\nThere are 95 printable keyboard-friendly ASCII characters. Many systems these days will accept
\nUTF-8, but we’ll just stick with ASCII, as it’s good enough. A 16 character random password
\ntaken from the 95 printable ASCII characters gives 44,012,666,865,176,569,775,543,212,890,625
\ncombinations. That’s 44 million * trillion * trillion. On average you’ll only need to crack half that
\nto crack any given password, so call it 22 million * trillion * trillion. At a trillion hashes a second,
\nthat’s still going to take, on average, 22 million trillion seconds.
\nPassword strenth 3 of 3 3\/26\/2013
\nThat’s a lot of seconds. It’s a hair under 700 billion years, or about 50 times the current age of the
\nuniverse.
\nYou might complain that the supercomputer is too small. But it doesn’t really matter. Even with
\n100,000 GPUs (and that’s a lot) you’re looking at 7 billion years. Maybe your GPUs are better,
\nand can do 4 billion hashes per second. Great; you’re still looking at more than 1 billion years.
\nA billion years is a really long time.
\nNow let’s look at your XKCD password. The idea here is that they’re four common words strung
\ntogether. Typical English speakers have a spoken vocabulary of 10-20,000 words, and a working
\nknowledge of 35-50,000 words. Four words out of 35,000 gives a total of just
\n1,500,625,000,000,000,000 passwords. Our trillion hash per second supercomputer can crack that
\non average in 8.6 days, and can crack it exhaustively in 17 days. Perhaps you’ll use some really
\nobscure words (which is rather undermining the point, because you’re less likely to remember
\nreally obscure words); four from 100,000 can be cracked exhaustively by our trillion hash
\nsupercomputer in 3 years. Perhaps you’ll decide to span most written English, and pick four from
\na million words. That’s stepped up the difficulty a lot–our supercomputer would now take almost
\n16,000 years, on average.
\nBut it’s a blink of an eye compared to the 700 billion years that it’d take for random selection of
\n16 ASCII printable characters to be brute forced.
\n——————-end—————–<\/p>\n","protected":false},"excerpt":{"rendered":"Basically, wireless security requires WPA2 encryption (with a complex pass-phrase that is not included in any pass-phrase dictionaries), MAC address filtering, and no remote administration of the router. Here’s a great link describing these opportunities:http:\/\/www.labnol.org\/internet\/secure-your-wireless-wifi-network\/10549\/ And here’s a cartoon about making a safe pass-phrase: http:\/\/xkcd.com\/936\/ http:\/\/imgs.xkcd.com\/comics\/password_strength.png And finally: The following are from comments on an […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-525","post","type-post","status-publish","format-standard","hentry","category-general"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts\/525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/comments?post=525"}],"version-history":[{"count":0,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/posts\/525\/revisions"}],"wp:attachment":[{"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/media?parent=525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/categories?post=525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systemsolver.goodhealthyday.com\/StatlerBlog\/wp-json\/wp\/v2\/tags?post=525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/imgs.xkcd.com\/comics\/password_strength.png)
<\/p>\n