Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security

Many Password Strength Meters Are Downright Weak, Researchers Say 159

Posted by timothy from the it's-like-pressing-the-walk-button dept.
alphadogg writes "Website password strength meters often tell you only what you want to hear rather than what you need to hear. That's the finding from researchers at Concordia University in Montreal, who examined the usefulness of those ubiquitous red-yellow-green password strength testers on websites run by big names such as Google, Yahoo, Twitter and Microsoft/Skype. The researchers used algorithms to send millions of 'not-so-good' passwords through these meters, as well as through the meters of password management services such as LastPass and 1Password, and were largely underwhelmed by what they termed wildly inconsistent results. Inconsistent can go both directions: I've seen password-strength meters that balked at absolutely everything (accepting weak passwords as good, after calling wildly long and random ones poor).
This discussion has been archived. No new comments can be posted.

Many Password Strength Meters Are Downright Weak, Researchers Say More

Many Password Strength Meters Are Downright Weak, Researchers Say

Comments Filter:

  • is this good? (Score:3, Funny)

    by twitnutttt ( 2958183 ) on Thursday March 26, 2015 @11:23AM (#49346153)

    123Password is very strong because it uses numbers and upper and lower case letters.
    Those meters are stupid.

    • Of course it's strong! That's why I use it for my luggage!

    • Re:is this good? (Score:5, Interesting)

      by jeffmeden ( 135043 ) on Thursday March 26, 2015 @11:35AM (#49346331) Homepage Journal

      123Password is very strong because it uses numbers and upper and lower case letters.
      Those meters are stupid.

      As long as it's not one of either this list: http://gizmodo.com/the-25-most... [gizmodo.com] or just a copy of your exact username, then yep it will probably suit you just fine. Dictionary attacks don't happen in break ins nearly as often as exploiting password resets (via social engineering or otherwise) or other blatant sidesteps of security (token reuse, etc), since everyone tarpits bad logins, sometimes after as few as 3 attempts.

      • Re:is this good? (Score:4, Informative)

        by Michael Casavant ( 2876793 ) on Thursday March 26, 2015 @11:55AM (#49346613)
        Except when an entire password database is stolen by hackers. Then, dictionary attacks are used first. That is the exact time you want a good password: Make the dictionary attack fail and brute-force the only option.

        Remember, most hack attempts don't get reported until the account information starts being used or sold.

      • Re: (Score:2, Flamebait)

        by sexconker ( 1179573 )

        123Password is very strong because it uses numbers and upper and lower case letters.
        Those meters are stupid.

        As long as it's not one of either this list: http://gizmodo.com/the-25-most... [gizmodo.com] or just a copy of your exact username, then yep it will probably suit you just fine. Dictionary attacks don't happen in break ins nearly as often as exploiting password resets (via social engineering or otherwise) or other blatant sidesteps of security (token reuse, etc), since everyone tarpits bad logins, sometimes after as few as 3 attempts.

        Hey, retard, pay attention. The typical attack scenario is as follows:
        A: Company gets hacked.
        B: The user table with password hashes is accessed.
        C: At some point in the future the company realizes it.
        D: At some later point in the future the company is forced to announce the breach. The company will lie as much as possible about what was accessed, when, how passwords were stored, that they never held onto your credit card numbers, how they're revamping security and they take your privacy very seriously,

        • Re: (Score:2, Funny)

          by Anonymous Coward

          You take the data offline and fuck on it at full speed.

          No, I use a mattress and I pace myself.

        • Between B and C, the attackers (and anyone they've sold the dump to) are busy cracking the passwords (assuming they weren't stored in plaintext) offline. They don't have to worry about being locked out after 3 fucking attempts. No one does brute force / dictionary attacks against online fucking data you clown. You take the data offline and fuck on it at full speed.

          They do the brute force thing in A before they have access and time it such that they don't hit the lock outs.

          For instance, most Windows systems will lock an account for 30 minutes when you hit the lockout. After 30 minutes, you're free to try again. Other systems behave similarly; most never do a true lockout.

          So what do they do for A? Loop over a list, try the entry until locked out or gain access. If locked out, put it back in the queue and try again later. Move to the next entry.

          If you want to o

          • OpenVMS handles invalid logons correctly. It locks out the terminal (that is, the network address) of the intruder. Why Microsoft, and most of the rest of the industry, does not understand how this is more secure and less vulnerable to DOS, I don't know.

      • Re: (Score:2)

        by Rakarra ( 112805 )

        From the article, this is troubling:

        3. 12345 (Up 17)
        4. 12345678 (Down 1)

        12345678 is a much more secure password than 12345. If the latter is more in vogue now, it illustrates that too many aren't taking security seriously enough.

    • I once tried to set a password for iCloud using 20 letters, numbers and punctuation marks. It was rejected because it didn't contain a capital letter. Sigh...

      Result: iCloud passwords have lower entropy because the cracking algorithms no longer have to try passwords with only lower case letters. They can go through all the passwords with a leading capital letter in the same amount of time instead. (which is the obvious alteration 95% of users will make anyway)

      • They can go through all the passwords with a leading capital letter in the same amount of time instead. (which is the obvious alteration 95% of users will make anyway)

        I capitalize the first two letters, so I don't have this problem. Oh shizz jk jk jk I don't do that.

      • Re: (Score:2)

        by weszz ( 710261 )

        My credit union does this... I had to go low security, because it couldn't be longer than something like 8 or 10 characters, and I think originally they told me I couldn't have special characters as well... Their argument was that you would be locked out long before you could try many passwords anyway, so it is moot.

        I let him know my feelings because just before the whole new system for better security, I could use a 14+ character password with special characters and whatever else I wanted, now the more sec

      • I know about a bank that forces you to pick a password starting with three digits numbers, then you can use letters. This is one of the most idiotic security rule I have every seen. First of all, it reduces the entropy significantly and second it forces many people to write down their passwords because they cannot remember them because of the three digits number rule. Or they pick the three digits from their birthdate, street number, phone number or something like that.

        However, after three wrong trials, you

    • The "letter-number-symbol" verifiers are the bane of my existence.

      I have a really simply rule: "You may choose whatever password you wish. If your password is compromised, you will be denied further access to this system. If your job requires access to this system, you will be terminated."

      Maybe that's too severe, but if the user needs a little color-coded bar-graph to tell them how good their password is, that would suggest that (1) they don't understand what a password is actually protecting or is for, a

      • Companies and online entities need to learn that when you force people to use a capital letter, a number, and a symbol, that most likely the first letter will be the capital letter, the number will be 1, and the symbol will be !. Or maybe @. If they foist a wacky password or require one based on complex rules, it will either be written down, or be the most simple implementation of the rules.

        Enforce minimum length. Allow spaces. Make a comparatively small alphabet have sufficient entropy to withstand brute f

        • I think the greatest threat is not that passwords are too simple, but passwords are re-used. cuz then it doesn't matter how secure your system is, if some other mofo is hacked and the user has the same pwd in both places, then you'll be compromised.

          hint hint when you give users freedom to use a simple password that is easy to remember, they're more likely to use unique passwords. But when they have to use a c0mPleX! password, it will be reused because people's brains are only big enough for one complex pass

          • I think the greatest threat is not that passwords are too simple, but passwords are re-used.

            Yes, that is a huge issue, led to, in part, by complex rules.

            I once queried one of my client's security tables to find the instances where multiple users had the same password (stored as a hash). Even though I expected some repetition, I was shocked at how many people had the same passwords.

            And one more gripe: When I am limited to between 8 and 12 characters. WTF!? My passwords are dead easy to remember, but impossible to guess. And over 12 characters. Needless to say, I never remember that 8-12 char passwo

            • I think the greatest threat is not that passwords are too simple, but passwords are re-used.

              I once queried one of my client's security tables to find the instances where multiple users had the same password (stored as a hash). Even though I expected some repetition, I was shocked at how many people had the same passwords.

              I meant that a single user applies the same password to multiple sites. you're referring to many users who use the same password on one site.

        • If they foist a wacky password or require one based on complex rules, it will either be written down, or be the most simple implementation of the rules.

          LOL, I once did some contract work at a company who's IT department had some crazy stringent password requirements. You could walk around and find everyone's ridiculously long, complex password written on a post-it note on the side of their computer.

          There should be a rule. The complexity of the password requirements and the number of password changes required each year are directly proportional to the chance the password will be written down and taped to the computer.

          • I remember working at one place where the phone system had a password on each account that was forced to change every three months. The problem was that the system remembered every password you used and wouldn't let you repeat one. That seems a bit overkill for simple voice mail.

      • Re: (Score:3)

        by bws111 ( 1216812 )

        that would suggest that (1) they don't understand what a password is actually protecting or is for, and (2) the incentives aren't correctly aligned

        You missed the most obvious choice: they don't think like a criminal, and have no idea what lengths a criminal will go to, or the tools they will use, to break in.

        There is no other area in life where an ordinary person is expected or required to act like a complete paranoid, but that is exactly what is expected by you.

        The problem is not users, the problem is that passwords are a crappy way to protect something.

      • How do they actually work? Do they do any kind of entropy calculation, or check the data against known rainbow tables? Or do they just apply rules?

        AFAIK all I have seen clearly use a set of rules. Seems to be: length + number(yes/no) + symbol(yes/no) + capital letters (yes/no)
        For each "yes" a value is added to the length. The resulting sum is the metric.
        Advantage is that it's easy and fast. Disadvantage is that it's not all that good.
        Dictionary check + entropy calculation (using a dictionary for "correct battery horse staple" type password entropy checks) would be better but would also require far more computing power and availability of a dictionary.

  • Still waiting for a "hackability meter" (Score:5, Interesting)

    by jeffmeden ( 135043 ) on Thursday March 26, 2015 @11:29AM (#49346243) Homepage Journal

    The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.

    What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?

    • Comment removed (Score:4, Interesting)

      by account_deleted ( 4530225 ) on Thursday March 26, 2015 @11:39AM (#49346381)
      Comment removed based on user account deletion

      • The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.

        Your basis for saying bassword-complexity is irrelevant is that bad people would be doing online brute-forcing? They do matter somewhat when it comes to online-cracking, but the real relevancy doesn't lie there. The passwords matter when it comes to offline brute-forcing: the more complex the password the longer it'll take to crack it even if you have the hash for it. With good passwords and well-done hashing and salting you may end up cracking them for weeks by which time whoever you obtained them from will hopefully already have made their users change their passwords.

        Brute forcing offline is only a scenario that can take place after a breach has occurred. In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified(http://techcrunch.com/2015/01/...) make complexity 100% pointless, which is what I am getting at here.

        • Not sure how that got butchered but the link to the article about passwords being stored by providers in clear or near-cleartext is http://techcrunch.com/2015/01/... [techcrunch.com]

        • Comment removed based on user account deletion

          • In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified

            Considering how awfully many cases there have been where it has taken the company weeks or even months to notify anyone of the breach I'm going to have to disagree on that.

            That's my exact point. If a system is compromised and they are going after user data unnoticed, you are boned even if can't brute force your 5000 character epic passpoem, detailing the life and works of seven mythical Norse heroes (apologies to http://www.schneierfacts.com/f... [schneierfacts.com]). The only thing keeping you safe in that instance is staying the fuck away from downright terrible and negligent providers.

        • The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.

          Your basis for saying bassword-complexity is irrelevant is that bad people would be doing online brute-forcing? They do matter somewhat when it comes to online-cracking, but the real relevancy doesn't lie there. The passwords matter when it comes to offline brute-forcing: the more complex the password the longer it'll take to crack it even if you have the hash for it. With good passwords and well-done hashing and salting you may end up cracking them for weeks by which time whoever you obtained them from will hopefully already have made their users change their passwords.

          Brute forcing offline is only a scenario that can take place after a breach has occurred. In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified

          Breaches are typically not noticed for months, and companies do everything in their power to NOT notify users for as long as possible and to lie to users about what was accessed and how it was stored. A password of "veronica" would be cracked in seconds.

          • The only real protection is to use different passwords for every service you care about.

            • which is what I do and what I tell everybody to do. it doesn't have to be hard, it can be a system that is easy to remember. It defeats the two biggest threats to a user: 1) brute forcing "123456" and 2) getting hacked on site X because somebody pwned your password on site Y.

            • I like to introduce as much entropy into the system as possible. It is really sad that my bank has a max password length of 24 chars while my credit card offers 32. Also my credit card will allow me to change my username at any time to a string of up to 32 chars. There is the additional security "feature" that they offer of having those silly questions but even there my credit card offers you the option to have more than 3 questions and the answers can be longer than the ones for my bank. So to access my ba

      • Re: (Score:2)

        by brunes69 ( 86786 )

        If more sites allowed federated login instead of rolling their own half-assed authentication regiemes then this wouldn't be a problem in the first place.

        The idea that I am more secure cooking up a "safe password" for JoeBlowsRandomWordpressInstance.com instead of logging in securely using Google or Facebook is farcical.

        • Yes but now privacy geeks like me will object to being tracked even more by Facebook and Google.

          • Re: (Score:2)

            by brunes69 ( 86786 )

            Then roll your own OpenID provider. This is what standards are for.

            Don't bash federated login just because you don't trust Google.. you don't HAVE to trust them, that is the whole point.

            The problem is not Google/Facebook/Yahoo/Twitter, the problem is The Guardian/Techcrunch/JoeBLow.com and every other website out there that forces you to make YET ANOTHER account with YET ANOTHER password because they do not support any federated login standards at all.

      • Re: (Score:2)

        by Tom ( 822 )

        This is right, but depends a lot on your threat scenario. For many applications where security really matters, both online and offline cracking are by far not the biggest risks.

    • Sorry, but password complexity matters a great deal. When a website's passwords get hacked, they're going to compare hashes and find all the easiest ones first (password, hunter2, 123456, etc). If yours is 15 characters of random letters, numbers, etc, yours will not get cracked first. Now, if someone like the NSA is targeting YOU, then it doesn't matter how complex it is; it will get cracked. But in a list of 5,000,000 passwords, having a complex password can help make sure yours is not one of those cracke

      • Sorry, but password complexity matters a great deal. When a website's passwords get hacked, they're going to compare hashes and find all the easiest ones first (password, hunter2, 123456, etc). If yours is 15 characters of random letters, numbers, etc, yours will not get cracked first. Now, if someone like the NSA is targeting YOU, then it doesn't matter how complex it is; it will get cracked. But in a list of 5,000,000 passwords, having a complex password can help make sure yours is not one of those cracked.

        This is my exact point. You are right if and only if the provider didn't bother to use an effective salt, which renders rainbow tables pointless. Why isn't that part of the meter? "Your password is stored in a hash of type XXX that is ### bits long, hashed for ### rounds, and salted with ### bits during each round." would tell the user all they need to know about how well their password is going to be protected, and they can make a more informed decision.

        • Re: (Score:2)

          by rHBa ( 976986 )

          "Your password is stored in a hash of type XXX that is ### bits long, hashed for ### rounds, and salted with ### bits during each round." would tell the user all they need to know about how well their password is going to be protected, and they can make a more informed decision.

          Why isn't that part of the meter? Because 99% of users have absolutely no idea what any of that means. It would be a good idea to have that information available to anyone who cares* but it would confuse most users, maybe even put them off signing up.

          * Of course users SHOULD care but most don't or at least don't have the time/inclination to learn.

          • Re: (Score:2)

            by uncqual ( 836337 )

            Of course users SHOULD care but most don't or at least don't have the time/inclination to learn.

            Why should they care? They should expect the web site provider to Do The Right Thing just as they don't think they should need to be concerned if the process used to grow the material used in the turbine blades of the jet engine on the plane they are flying on was correctly monitored.

            • Re: (Score:2)

              by rHBa ( 976986 )
              Agreed that there is no reason users should need to know HOW their passwords are stored but they should care that their passwords are stored safely. Just as an airline passenger should care that the aeroplane they are flying in was manufactured to the highest standards, without needing to know the details of the manufacturing process.

      • Re: (Score:2)

        by Jaime2 ( 824950 )
        But, the main use of cracked offline passwords is to use that password on other services. The current service is already compromised as the person doing offline cracking has the database already. As long as you don't re-use passwords, it doesn't matter that much.

    • Re: (Score:2)

      by Kjella ( 173770 )

      What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?

      Are you secretly planning to use it as a Dunning-Kruger meter and avoid all that self-rate as 10 out of 10? Because if you think you'll get anything else useful out of it, I want some of what you're smoking...

      • What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?

        Are you secretly planning to use it as a Dunning-Kruger meter and avoid all that self-rate as 10 out of 10? Because if you think you'll get anything else useful out of it, I want some of what you're smoking...

        Both are farcical. Good catch.

        The point is that a site could very easily be giving you great password strength advice and then proceed to do something totally stupid with it (storing it with such a poor cipher that can be bruteforced in seconds.)

  • I know that my password - ********** - is very strong. I use it on all sites and even brute force hasn't worked yet. So, nyah, to the password meters.

  • Lovely Meter Maid (Score:3, Funny)

    by Tablizer ( 95088 ) on Thursday March 26, 2015 @11:42AM (#49346411) Journal

    So we need a meter for meters now.

  • Those meters are all over the place. As the article mentioned, the majority of them only count the number of characters in each class, so they're pretty terrible at actually telling you how hard your password is to crack. Some of them are set to an absurdly high level too. The default Ubuntu meter for instance requires something like 16 characters before it will even consider your password good. I saw one where it wouldn't take your password unless it was at least 14 characters long, had all classes of

  • that we're doing it exactly backwards. https://xkcd.com/936/ [xkcd.com]

    Are we ever going to make strong passwords? Ever?

    For God's sake, password strength meters were either invented by an incompetent or by the NSA to weaken the web.

    • >> Are we ever going to make strong passwords? Ever?

      I doubt it. The momentum is swinging the other way with mobile devices; people want passwords they can type quickly on touch-screens with their stubby thumbs without switching keyboards.

  • Users are *bad* at choosing passwords (Score:5, Insightful)

    by MetricT ( 128876 ) on Thursday March 26, 2015 @12:02PM (#49346699)

    I run a GPU cracker on my user's password hashes to preemptively weed out weak passwords. Several times I have seen them try to change it from (for example) "password" to P@ssw0rd99", which in a certain sense is significantly more complex, but OCLHashCat has rules for capitalization, leet-speak, appending/prepending numbers. You've only changed the time it takes to crack that hash from fractions of a second to a few minutes.

    The only highly secure password requires long, random characters. Given a choice, users will always prefer an easy-to-remember password because it makes their life easier. Unfortunately, it also makes the bad guy's life easier, and the sysadmin's life harder.

    Websites should be required to disclose the hash format they are storing user's passwords in, to hopefully prevent another Linkedin plain-md5 type debacle.

  • Single factor authentication (ie password) is a people problem. If access to a site is granted by matching an identifier with one other piece of information, then it is the risk created by the compromise of those credentials that should govern how "strong" those credentials need to be.

    Financial information? Strong. Personal Health information? Strong. Email? Depends on how interesting you are. Hardware store loyalty points? Meh.

    The more important point from the article is this:
    "In fact, research from

  • The whole premise is wrong wrong. Teach users what (Score:5, Insightful)

    by Cafe Alpha ( 891670 ) on Thursday March 26, 2015 @12:11PM (#49346797) Journal

    entropy is, and how to measure it. Then we will solve the problem. Oh my God there is nothing worse than what passes for good passwords. People are good at remembering sentences and those have lots of entropy. People are terrible at remembering what we call passwords and those have very little.

    We're just doing this wrong from beginning to end.

  • Weak Web Sites (Score:3)

    by Greyfox ( 87712 ) on Thursday March 26, 2015 @12:29PM (#49347019) Homepage Journal
    Most of those web sites are not one's I'm likely to return to anyway. Like a corporate web site for some company I clicked on a job posting for. And now it's asking me to create an account with my E-Mail address and a password. The only information in the account that the password is protecting is an E-Mail address, and I'm not likely to ever return to that site. At this point I'm already pretty sure I don't want to work for that company. If they bitch at me about the strength of the password I chose, that's really just going to make up my mind for me at that point. If I ever DO return to the site, I'm not even likely to remember that I ever created an account there, much less what the password was, so I'm just going to have to click on the "forgot password" link, anyway. I've had sites like this send me the original password in plain text, too.

    • Re: (Score:2)

      by gewalker ( 57809 )

      Any company or website that can recover your password is plain text is clearly run by idiots with respect to security. Consider it a blessing that they chose to reveal that to you clearly so that you can avoid them.

  • We should launch a massive research effort (Score:5, Funny)

    by tlambert ( 566799 ) on Thursday March 26, 2015 @12:47PM (#49347253)

    We should launch a massive research effort, figure out the strongest possible password, and make everyone use that.

  • Helpful websites will provide (Score:3)

    by mpercy ( 1085347 ) on Thursday March 26, 2015 @12:48PM (#49347277)

    A reminder about their password requirements.

    I cannot begin to count the number of times I've had to hit "Forgot my password" simply because they do not remind me up fron that my password must have special character in it. For websites that do not have my personal information and especially not financial (blog sites, sport sites) I tend to use a common password so I don't have to remember different passwords. Again, completely different from any important password and used only for essentially throwaway sites.

    But some sites require at least digit, others at least one Capital letter (or at least one lowercase), others at least one special character, others some combination.

    The throwaway password usually meets these by virtue of the way it is constructed, but not always. Sometimes it has to be doubled to meet a length requirement, for example. But while they tell you this when you create the password, they never seem to remind you when you later have to enter your password.

  • There is also a problem with password length limit (Score:5, Insightful)

    by Tyrannosaur ( 2485772 ) on Thursday March 26, 2015 @12:58PM (#49347419)

    There are also often (not told to the user!) length limits on passwords

    I like making my passwords a sentence. Whether it is more secure or not, it is easier for me to remember and I like to pretend I believe it is super secure.

    However, I have had several places where I make a user, make a password (which it thinks is super strong because it is like 50 characters), copy-paste it somewhere, and it says I have a user. I then try to login using the copy-pasted password, and it tells me I have a bad password. going through the password-reset process, it invariably works if I reset it to a much shorter password.

    This is a bug that really annoys me, especially with xkcd encouraging people who might not know about this popular bug to make long passwords.

    • Note: copying and pasting passwords is a hell of a security hole. Every single program can read the clipboard.

    • Sorry I guess I didn't describe the bug properly: often websites accept a long password to create the password, but apparently drop the rest of the string after a certain amount of characters which makes a password of fewer characters than the user wanted.

      This wouldn't cause a problem (aside from being a security hole) except when I go to type in my long password to log in, the software takes the entire string and does not drop off the characters after the limit used in creating the password, effectively ma

  • If different rules for each meter helps people pick a different password for each site, this is a win. To a large extent, I need to trust Facebook to protect my Facebook data from breach at Facebook. However, it really is up to me to protect my Facebook data from a breach at Google.

  • 1) Computers are, by design, a tool to lessen entropy. Computers sail through an Internet of chaos and disorder like icebreakers leaving a trail of ordered, aligned wreckage in their wake.

    2) Any program or method employed by a computer to evaluate the "entropic value" of a string in the end means absolutely nothing except that it correlates to other virtual "entropic values" of other strings like it using purely ordered, metered and aligned correspondences of information bits.

    3) Computers interacting or ev

  • I'm surprised that Passfault [appspot.com] was not mentioned in the paper TFA references, since it specifically checks for dictionary attacks in multiple languages, and for substitutions, reversals, keyboard shifts, and other transforms that an advanced cracking program might check. It's open source, too. Yet no one else even mentioned it in this discussion, when Slashdot is how I know about it in the first place.

  • In fact, they're ridiculous. I've given a couple presentations on password strength, and password meters are to password strength what the TSA is for air travel security - a better-than-nothing baseline approach that is mostly for show.

    The problem is that we have nothing better to offer at this time, even though most security experts agree that passwords are a solution whose time is over.

  • Prior to landing on /. for the Nth time today ( is a slow day ) I finished reading an article about password complexity and a system called " DiceWare "

    The main article can be found here [firstlook.org] with the Wikipedia version here [wikipedia.org]

    The system doesn't rely on crazy levels of complexity in a password, rather longer and random words combined to form phrases which are far easier to remember. If only we could get some sort of standard in place so that every website you visit doesn't use their own in house rules for pas

  • What does "password strength" really mean?

    If people used a textual representation of number obtained from a reliable hardware random number generator then the meaning would be unambiguous. It's the number of digits in that number. But most people don't do that (perhaps more should).

    So what does it mean to say that a password has so many bits of entropy? Well, I guess it means how many truly random bits it would take to index their password from the universe of passwords the user considered. This is more

  • I've never trusted the online "tester' sites. The paranoid side of my brain says the site's purpose is, "Hey, let's take this guy's clever password that a dictionary/brute force attack would never ever be able to break, hash it out,and then compare the hash to others we've already stolen. Profit!"

  • I use passphrases - but not the phrases themselves. I come up with a really long sentence and then just use the first one or two letters from each word.

    So, like I would come up with a phrase such as "I like Robert Reich, and think he should run for president in 2016" I would have a password "ilrr,athsrfpi2016" that would be easy to remember. Even if it were somehow tangentally related to a site by topic or theme or "feel" it is a whole lot more secure than a combination of dictionary words and numbers, beca

  • Why does my Slashdot account need a password stronger than that?

  • It's pretty obvious to me that the real solution is to store passwords in a hardware black-box (with a mirrored spare) that only allows a limited number of tries for a given password and all passwords per time period. E.i. throttled.

    Computers are getting to fast to permit them to chomp on raw encrypted files.

Slashdot Top Deals

Never test for an error condition you don't know how to handle. -- Steinbach

Close