Many Password Strength Meters Are Downright Weak, Researchers Say 159
alphadogg writes "Website password strength meters often tell you only what you want to hear rather than what you need to hear. That's the finding from researchers at Concordia University in Montreal, who examined the usefulness of those ubiquitous red-yellow-green password strength testers on websites run by big names such as Google, Yahoo, Twitter and Microsoft/Skype. The researchers used algorithms to send millions of 'not-so-good' passwords through these meters, as well as through the meters of password management services such as LastPass and 1Password, and were largely underwhelmed by what they termed wildly inconsistent results.
Inconsistent can go both directions: I've seen password-strength meters that balked at absolutely everything (accepting weak passwords as good, after calling wildly long and random ones poor).
is this good? (Score:3, Funny)
123Password is very strong because it uses numbers and upper and lower case letters.
Those meters are stupid.
Re: (Score:3)
Re:is this good? (Score:5, Interesting)
123Password is very strong because it uses numbers and upper and lower case letters.
Those meters are stupid.
As long as it's not one of either this list: http://gizmodo.com/the-25-most... [gizmodo.com] or just a copy of your exact username, then yep it will probably suit you just fine. Dictionary attacks don't happen in break ins nearly as often as exploiting password resets (via social engineering or otherwise) or other blatant sidesteps of security (token reuse, etc), since everyone tarpits bad logins, sometimes after as few as 3 attempts.
Re:is this good? (Score:4, Informative)
Remember, most hack attempts don't get reported until the account information starts being used or sold.
Re: (Score:2, Flamebait)
123Password is very strong because it uses numbers and upper and lower case letters.
Those meters are stupid.
As long as it's not one of either this list: http://gizmodo.com/the-25-most... [gizmodo.com] or just a copy of your exact username, then yep it will probably suit you just fine. Dictionary attacks don't happen in break ins nearly as often as exploiting password resets (via social engineering or otherwise) or other blatant sidesteps of security (token reuse, etc), since everyone tarpits bad logins, sometimes after as few as 3 attempts.
Hey, retard, pay attention. The typical attack scenario is as follows:
A: Company gets hacked.
B: The user table with password hashes is accessed.
C: At some point in the future the company realizes it.
D: At some later point in the future the company is forced to announce the breach. The company will lie as much as possible about what was accessed, when, how passwords were stored, that they never held onto your credit card numbers, how they're revamping security and they take your privacy very seriously,
Re: (Score:2, Funny)
No, I use a mattress and I pace myself.
Re: (Score:2)
Between B and C, the attackers (and anyone they've sold the dump to) are busy cracking the passwords (assuming they weren't stored in plaintext) offline. They don't have to worry about being locked out after 3 fucking attempts. No one does brute force / dictionary attacks against online fucking data you clown. You take the data offline and fuck on it at full speed.
They do the brute force thing in A before they have access and time it such that they don't hit the lock outs.
For instance, most Windows systems will lock an account for 30 minutes when you hit the lockout. After 30 minutes, you're free to try again. Other systems behave similarly; most never do a true lockout.
So what do they do for A? Loop over a list, try the entry until locked out or gain access. If locked out, put it back in the queue and try again later. Move to the next entry.
If you want to o
Re: (Score:2)
Re: (Score:2)
From the article, this is troubling:
3. 12345 (Up 17)
4. 12345678 (Down 1)
12345678 is a much more secure password than 12345. If the latter is more in vogue now, it illustrates that too many aren't taking security seriously enough.
Re: (Score:2)
I once tried to set a password for iCloud using 20 letters, numbers and punctuation marks. It was rejected because it didn't contain a capital letter. Sigh...
Result: iCloud passwords have lower entropy because the cracking algorithms no longer have to try passwords with only lower case letters. They can go through all the passwords with a leading capital letter in the same amount of time instead. (which is the obvious alteration 95% of users will make anyway)
Re: (Score:2)
They can go through all the passwords with a leading capital letter in the same amount of time instead. (which is the obvious alteration 95% of users will make anyway)
I capitalize the first two letters, so I don't have this problem. Oh shizz jk jk jk I don't do that.
Re: (Score:2)
My credit union does this... I had to go low security, because it couldn't be longer than something like 8 or 10 characters, and I think originally they told me I couldn't have special characters as well... Their argument was that you would be locked out long before you could try many passwords anyway, so it is moot.
I let him know my feelings because just before the whole new system for better security, I could use a 14+ character password with special characters and whatever else I wanted, now the more sec
Re: (Score:2)
I know about a bank that forces you to pick a password starting with three digits numbers, then you can use letters. This is one of the most idiotic security rule I have every seen. First of all, it reduces the entropy significantly and second it forces many people to write down their passwords because they cannot remember them because of the three digits number rule. Or they pick the three digits from their birthdate, street number, phone number or something like that.
However, after three wrong trials, you
Re: (Score:2)
The "letter-number-symbol" verifiers are the bane of my existence.
I have a really simply rule: "You may choose whatever password you wish. If your password is compromised, you will be denied further access to this system. If your job requires access to this system, you will be terminated."
Maybe that's too severe, but if the user needs a little color-coded bar-graph to tell them how good their password is, that would suggest that (1) they don't understand what a password is actually protecting or is for, a
Re: (Score:3)
Companies and online entities need to learn that when you force people to use a capital letter, a number, and a symbol, that most likely the first letter will be the capital letter, the number will be 1, and the symbol will be !. Or maybe @. If they foist a wacky password or require one based on complex rules, it will either be written down, or be the most simple implementation of the rules.
Enforce minimum length. Allow spaces. Make a comparatively small alphabet have sufficient entropy to withstand brute f
Re: (Score:2)
I think the greatest threat is not that passwords are too simple, but passwords are re-used. cuz then it doesn't matter how secure your system is, if some other mofo is hacked and the user has the same pwd in both places, then you'll be compromised.
hint hint when you give users freedom to use a simple password that is easy to remember, they're more likely to use unique passwords. But when they have to use a c0mPleX! password, it will be reused because people's brains are only big enough for one complex pass
Re: (Score:2)
I think the greatest threat is not that passwords are too simple, but passwords are re-used.
Yes, that is a huge issue, led to, in part, by complex rules.
I once queried one of my client's security tables to find the instances where multiple users had the same password (stored as a hash). Even though I expected some repetition, I was shocked at how many people had the same passwords.
And one more gripe: When I am limited to between 8 and 12 characters. WTF!? My passwords are dead easy to remember, but impossible to guess. And over 12 characters. Needless to say, I never remember that 8-12 char passwo
Re: (Score:2)
I think the greatest threat is not that passwords are too simple, but passwords are re-used.
I once queried one of my client's security tables to find the instances where multiple users had the same password (stored as a hash). Even though I expected some repetition, I was shocked at how many people had the same passwords.
I meant that a single user applies the same password to multiple sites. you're referring to many users who use the same password on one site.
Re: (Score:2)
If they foist a wacky password or require one based on complex rules, it will either be written down, or be the most simple implementation of the rules.
LOL, I once did some contract work at a company who's IT department had some crazy stringent password requirements. You could walk around and find everyone's ridiculously long, complex password written on a post-it note on the side of their computer.
There should be a rule. The complexity of the password requirements and the number of password changes required each year are directly proportional to the chance the password will be written down and taped to the computer.
Re: (Score:2)
Re: (Score:3)
that would suggest that (1) they don't understand what a password is actually protecting or is for, and (2) the incentives aren't correctly aligned
You missed the most obvious choice: they don't think like a criminal, and have no idea what lengths a criminal will go to, or the tools they will use, to break in.
There is no other area in life where an ordinary person is expected or required to act like a complete paranoid, but that is exactly what is expected by you.
The problem is not users, the problem is that passwords are a crappy way to protect something.
Re: (Score:2)
How do they actually work? Do they do any kind of entropy calculation, or check the data against known rainbow tables? Or do they just apply rules?
AFAIK all I have seen clearly use a set of rules. Seems to be: length + number(yes/no) + symbol(yes/no) + capital letters (yes/no)
For each "yes" a value is added to the length. The resulting sum is the metric.
Advantage is that it's easy and fast. Disadvantage is that it's not all that good.
Dictionary check + entropy calculation (using a dictionary for "correct battery horse staple" type password entropy checks) would be better but would also require far more computing power and availability of a dictionary.
Still waiting for a "hackability meter" (Score:5, Interesting)
The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.
What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?
Comment removed (Score:4, Interesting)
Re: (Score:2)
The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.
Your basis for saying bassword-complexity is irrelevant is that bad people would be doing online brute-forcing? They do matter somewhat when it comes to online-cracking, but the real relevancy doesn't lie there. The passwords matter when it comes to offline brute-forcing: the more complex the password the longer it'll take to crack it even if you have the hash for it. With good passwords and well-done hashing and salting you may end up cracking them for weeks by which time whoever you obtained them from will hopefully already have made their users change their passwords.
Brute forcing offline is only a scenario that can take place after a breach has occurred. In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified(http://techcrunch.com/2015/01/...) make complexity 100% pointless, which is what I am getting at here.
Re: (Score:2)
Not sure how that got butchered but the link to the article about passwords being stored by providers in clear or near-cleartext is http://techcrunch.com/2015/01/... [techcrunch.com]
Re: (Score:3)
Re: (Score:2)
In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified
Considering how awfully many cases there have been where it has taken the company weeks or even months to notify anyone of the breach I'm going to have to disagree on that.
That's my exact point. If a system is compromised and they are going after user data unnoticed, you are boned even if can't brute force your 5000 character epic passpoem, detailing the life and works of seven mythical Norse heroes (apologies to http://www.schneierfacts.com/f... [schneierfacts.com]). The only thing keeping you safe in that instance is staying the fuck away from downright terrible and negligent providers.
Re: (Score:3)
The plain simple truth is that complexity of a password is barely relevant at all when compared to the threat of an outright data breach at a provider. Who cares if your password is 'veronica' (your daughters name) or `myL1ttleBr0ny%` since an attacker isn't going to bother with brute forcing anything but '123456' and 'password' because they will get tarpitted by any reputable provider before they can guess anything out of a dictionary more than 5 entries long.
Your basis for saying bassword-complexity is irrelevant is that bad people would be doing online brute-forcing? They do matter somewhat when it comes to online-cracking, but the real relevancy doesn't lie there. The passwords matter when it comes to offline brute-forcing: the more complex the password the longer it'll take to crack it even if you have the hash for it. With good passwords and well-done hashing and salting you may end up cracking them for weeks by which time whoever you obtained them from will hopefully already have made their users change their passwords.
Brute forcing offline is only a scenario that can take place after a breach has occurred. In that case, even a password of 'veronica' should be strong enough to last until the breach is discovered (days?), the user notified
Breaches are typically not noticed for months, and companies do everything in their power to NOT notify users for as long as possible and to lie to users about what was accessed and how it was stored. A password of "veronica" would be cracked in seconds.
Re: (Score:2)
Re: (Score:2)
which is what I do and what I tell everybody to do. it doesn't have to be hard, it can be a system that is easy to remember. It defeats the two biggest threats to a user: 1) brute forcing "123456" and 2) getting hacked on site X because somebody pwned your password on site Y.
Re: (Score:2)
Re: (Score:2)
If more sites allowed federated login instead of rolling their own half-assed authentication regiemes then this wouldn't be a problem in the first place.
The idea that I am more secure cooking up a "safe password" for JoeBlowsRandomWordpressInstance.com instead of logging in securely using Google or Facebook is farcical.
Re: (Score:2)
Re: (Score:2)
Then roll your own OpenID provider. This is what standards are for.
Don't bash federated login just because you don't trust Google.. you don't HAVE to trust them, that is the whole point.
The problem is not Google/Facebook/Yahoo/Twitter, the problem is The Guardian/Techcrunch/JoeBLow.com and every other website out there that forces you to make YET ANOTHER account with YET ANOTHER password because they do not support any federated login standards at all.
Re: (Score:2)
This is right, but depends a lot on your threat scenario. For many applications where security really matters, both online and offline cracking are by far not the biggest risks.
Re: (Score:2)
Re: (Score:2)
Sorry, but password complexity matters a great deal. When a website's passwords get hacked, they're going to compare hashes and find all the easiest ones first (password, hunter2, 123456, etc). If yours is 15 characters of random letters, numbers, etc, yours will not get cracked first. Now, if someone like the NSA is targeting YOU, then it doesn't matter how complex it is; it will get cracked. But in a list of 5,000,000 passwords, having a complex password can help make sure yours is not one of those cracked.
This is my exact point. You are right if and only if the provider didn't bother to use an effective salt, which renders rainbow tables pointless. Why isn't that part of the meter? "Your password is stored in a hash of type XXX that is ### bits long, hashed for ### rounds, and salted with ### bits during each round." would tell the user all they need to know about how well their password is going to be protected, and they can make a more informed decision.
Re: (Score:2)
"Your password is stored in a hash of type XXX that is ### bits long, hashed for ### rounds, and salted with ### bits during each round." would tell the user all they need to know about how well their password is going to be protected, and they can make a more informed decision.
Why isn't that part of the meter? Because 99% of users have absolutely no idea what any of that means. It would be a good idea to have that information available to anyone who cares* but it would confuse most users, maybe even put them off signing up.
* Of course users SHOULD care but most don't or at least don't have the time/inclination to learn.
Re: (Score:2)
Why should they care? They should expect the web site provider to Do The Right Thing just as they don't think they should need to be concerned if the process used to grow the material used in the turbine blades of the jet engine on the plane they are flying on was correctly monitored.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Why should there be a character limit on passwords? Providing you're hashing them then storing them just needs a constant width field. If you're dealing with html inputs, then the default is not to have a maxlength attribute and if you're POSTing the form data then you're unlikely to hit any limits.
Re: (Score:2)
What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?
Are you secretly planning to use it as a Dunning-Kruger meter and avoid all that self-rate as 10 out of 10? Because if you think you'll get anything else useful out of it, I want some of what you're smoking...
Re: (Score:2)
What we need is a meter on a web site describing how much effort they put into server security, how big their target profile is (how many entry points they have) and a sign that says "??? days since a total data breach!", and then the user can decide if they want an account there at all. How's that coming?
Are you secretly planning to use it as a Dunning-Kruger meter and avoid all that self-rate as 10 out of 10? Because if you think you'll get anything else useful out of it, I want some of what you're smoking...
Both are farcical. Good catch.
The point is that a site could very easily be giving you great password strength advice and then proceed to do something totally stupid with it (storing it with such a poor cipher that can be bruteforced in seconds.)
Re: (Score:2)
You're a fucking shitheel. The vast majority of passwords are cracked offline. The only things saving you, the user, when (not if) shit gets hacked are using strong passwords and not reusing them across services. "2-factor" authentication doesn't do fuck shit because the company got fucking hacked anyway - you can't trust that the keys for the RSA clocks weren't taken at the same time the user table was.
Of course any passwords that get cracked are cracked offline, it has been a long long time since even the most poorly architected of sites had an auth service capable of responding fast enough to brute force. The point is that more often still, passwords are lifted out of databases that don't bother to encrypt them at all, or passwords are "Cracked" by exploiting a poorly built password reset system to overwrite them. In those cases (which account for almost all of the malicious per-account activity), it
I use the same unhackable password (Score:2)
Re: (Score:2)
Re:I use the same unhackable password (Score:5, Funny)
I know that my password - hunter2 - is very strong
Doesn't look strong to me.
Lovely Meter Maid (Score:3, Funny)
So we need a meter for meters now.
Wildly inconsistent is putting it mildly (Score:2)
Password (Score:2)
http://i.imgur.com/UHGIx.jpg [imgur.com]
everyone who passed a math class knows (Score:2)
that we're doing it exactly backwards. https://xkcd.com/936/ [xkcd.com]
Are we ever going to make strong passwords? Ever?
For God's sake, password strength meters were either invented by an incompetent or by the NSA to weaken the web.
Re: (Score:2)
>> Are we ever going to make strong passwords? Ever?
I doubt it. The momentum is swinging the other way with mobile devices; people want passwords they can type quickly on touch-screens with their stubby thumbs without switching keyboards.
Re: (Score:2)
The advice is only wrong that he said "common words" and didn't give a random procedure for picking - the size of the dictionary matters, and expecting humans to be random without some help isn't reliable. If he said "take a paper dictionary, open it a random page and finger position and pick a word 5 times" he'd have extremely good advice.
Re: (Score:2)
Re: (Score:2)
There are several online generators based on the method, and if you don't trust that, there is the Diceware method [std.com] which uses 5 dice (or 1 die rolled 5 times) to randomly pick words off a list.
Re: (Score:2)
Well, if everyone only used the list provided, you have a valid point (actually, he provides an alternate, but the point still stands). However, it's trivial to generate a unique list for each user to work from, at which point you have far more entropy than with just the numbers from the dice.
Also, while attackers may be aware of the method, they'd have no way of knowing whether or not any given user is using it.
Users are *bad* at choosing passwords (Score:5, Insightful)
I run a GPU cracker on my user's password hashes to preemptively weed out weak passwords. Several times I have seen them try to change it from (for example) "password" to P@ssw0rd99", which in a certain sense is significantly more complex, but OCLHashCat has rules for capitalization, leet-speak, appending/prepending numbers. You've only changed the time it takes to crack that hash from fractions of a second to a few minutes.
The only highly secure password requires long, random characters. Given a choice, users will always prefer an easy-to-remember password because it makes their life easier. Unfortunately, it also makes the bad guy's life easier, and the sysadmin's life harder.
Websites should be required to disclose the hash format they are storing user's passwords in, to hopefully prevent another Linkedin plain-md5 type debacle.
Re: (Score:2)
Already thought of.
https://hashcat.net/wiki/doku.... [hashcat.net]
Re: (Score:2)
Passphrases *can* be done securely; most people won't. They will concatenate simple words, which means if I have a dictionary of, say, the top 1,000 words, it's still reasonably feasible to crack.
For instance, here are some long passphrase-like passwords that I cracked from the LinkedIn debacle. They used plain MD5 as the hash, which admittedly helps cracking a lot. I haven't tried the depleted hash list in a long time, but I'm willing to bet with advances in both OCLHashcat and my own skills, I could
And the point of the study is what? (Score:2)
Single factor authentication (ie password) is a people problem. If access to a site is granted by matching an identifier with one other piece of information, then it is the risk created by the compromise of those credentials that should govern how "strong" those credentials need to be.
Financial information? Strong. Personal Health information? Strong. Email? Depends on how interesting you are. Hardware store loyalty points? Meh.
The more important point from the article is this:
"In fact, research from
The whole premise is wrong wrong. Teach users what (Score:5, Insightful)
entropy is, and how to measure it. Then we will solve the problem. Oh my God there is nothing worse than what passes for good passwords. People are good at remembering sentences and those have lots of entropy. People are terrible at remembering what we call passwords and those have very little.
We're just doing this wrong from beginning to end.
Re: (Score:2)
Uhm you didn't understand what I typed.
If you pick 7 different words at random from a dictionary of 100,000 words and make a sentence from them you have log(100,000 choose 7)/log(2) bits of entropy that's 104 bits.
You'll never be able to remember a random character password worth 104 bits. Never. But you could remember a 7 word sentence.
Re: (Score:2)
Reordered with glue words between them, they can. None of that reduces the entropy, not the way I calculated it.
Notice I used choose, not powers.
Re: (Score:2)
If only society had some way of teaching people things so that they wouldn't be incompetent.
We could call it Skowol.
Re: (Score:2)
True enough.
Though you can do strange things like display a tiny hash picture when the user has finished - that can be a visual verification.
Weak Web Sites (Score:3)
Re: (Score:2)
Any company or website that can recover your password is plain text is clearly run by idiots with respect to security. Consider it a blessing that they chose to reveal that to you clearly so that you can avoid them.
We should launch a massive research effort (Score:5, Funny)
We should launch a massive research effort, figure out the strongest possible password, and make everyone use that.
Re: (Score:2)
Iiiiiiiiit's supercalifragilisticexpialidocious!
Helpful websites will provide (Score:3)
A reminder about their password requirements.
I cannot begin to count the number of times I've had to hit "Forgot my password" simply because they do not remind me up fron that my password must have special character in it. For websites that do not have my personal information and especially not financial (blog sites, sport sites) I tend to use a common password so I don't have to remember different passwords. Again, completely different from any important password and used only for essentially throwaway sites.
But some sites require at least digit, others at least one Capital letter (or at least one lowercase), others at least one special character, others some combination.
The throwaway password usually meets these by virtue of the way it is constructed, but not always. Sometimes it has to be doubled to meet a length requirement, for example. But while they tell you this when you create the password, they never seem to remind you when you later have to enter your password.
There is also a problem with password length limit (Score:5, Insightful)
There are also often (not told to the user!) length limits on passwords
I like making my passwords a sentence. Whether it is more secure or not, it is easier for me to remember and I like to pretend I believe it is super secure.
However, I have had several places where I make a user, make a password (which it thinks is super strong because it is like 50 characters), copy-paste it somewhere, and it says I have a user. I then try to login using the copy-pasted password, and it tells me I have a bad password. going through the password-reset process, it invariably works if I reset it to a much shorter password.
This is a bug that really annoys me, especially with xkcd encouraging people who might not know about this popular bug to make long passwords.
Re: (Score:2)
Note: copying and pasting passwords is a hell of a security hole. Every single program can read the clipboard.
Re: (Score:2)
I did not describe what I was doing very well; see my response to my original comment.
The clipboard is just being used to confirm the bug; the first time I attempt to create a password obviously I should not make a habit of doing this.
Re: (Score:2)
So long as the browsers hide my password with dots copy pasting is the only sufficiently reliable way to get temporary passwords right.
Re: (Score:2)
Sorry I guess I didn't describe the bug properly: often websites accept a long password to create the password, but apparently drop the rest of the string after a certain amount of characters which makes a password of fewer characters than the user wanted.
This wouldn't cause a problem (aside from being a security hole) except when I go to type in my long password to log in, the software takes the entire string and does not drop off the characters after the limit used in creating the password, effectively ma
Could be a good thing (Score:2)
Problem of Entropy+Computers (Score:2)
1) Computers are, by design, a tool to lessen entropy. Computers sail through an Internet of chaos and disorder like icebreakers leaving a trail of ordered, aligned wreckage in their wake.
2) Any program or method employed by a computer to evaluate the "entropic value" of a string in the end means absolutely nothing except that it correlates to other virtual "entropic values" of other strings like it using purely ordered, metered and aligned correspondences of information bits.
3) Computers interacting or ev
Why no Passfault in TFA? (Score:2)
yes, they are (Score:2)
In fact, they're ridiculous. I've given a couple presentations on password strength, and password meters are to password strength what the TSA is for air travel security - a better-than-nothing baseline approach that is mostly for show.
The problem is that we have nothing better to offer at this time, even though most security experts agree that passwords are a solution whose time is over.
Interesting Coincidence (Score:2)
Prior to landing on /. for the Nth time today ( is a slow day ) I finished reading an article about password complexity and a system called " DiceWare "
The main article can be found here [firstlook.org] with the Wikipedia version here [wikipedia.org]
The system doesn't rely on crazy levels of complexity in a password, rather longer and random words combined to form phrases which are far easier to remember. If only we could get some sort of standard in place so that every website you visit doesn't use their own in house rules for pas
Re: (Score:2)
LOL
Mere moments after posting this does a full story show up on the front page discussing this very subject :|
Re: (Score:2)
Dream on. Half the sites out there don't even allow a hyphen or a plus sign in an email address.
Perhaps the problem is with the concept. (Score:2)
What does "password strength" really mean?
If people used a textual representation of number obtained from a reliable hardware random number generator then the meaning would be unambiguous. It's the number of digits in that number. But most people don't do that (perhaps more should).
So what does it mean to say that a password has so many bits of entropy? Well, I guess it means how many truly random bits it would take to index their password from the universe of passwords the user considered. This is more
Paranoid? (Score:2)
I've never trusted the online "tester' sites. The paranoid side of my brain says the site's purpose is, "Hey, let's take this guy's clever password that a dictionary/brute force attack would never ever be able to break, hash it out,and then compare the hash to others we've already stolen. Profit!"
Use passphrases (Score:2)
I use passphrases - but not the phrases themselves. I come up with a really long sentence and then just use the first one or two letters from each word.
So, like I would come up with a phrase such as "I like Robert Reich, and think he should run for president in 2016" I would have a password "ilrr,athsrfpi2016" that would be easy to remember. Even if it were somehow tangentally related to a site by topic or theme or "feel" it is a whole lot more secure than a combination of dictionary words and numbers, beca
My ATM card still uses a 4-number PIN (Score:2)
Why does my Slashdot account need a password stronger than that?
Hardware Wall Needed (Score:2)
It's pretty obvious to me that the real solution is to store passwords in a hardware black-box (with a mirrored spare) that only allows a limited number of tries for a given password and all passwords per time period. E.i. throttled.
Computers are getting to fast to permit them to chomp on raw encrypted files.
Re: (Score:2)
I think you meant "fist".
Re: (Score:2)
They're generally implemented as client-side javascript, so there'd be about one request to the server, not millions.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Why would you even bother with prepending "tesco" unless you were reusing that "20+ psuedo-random character" string across other sites? That's shitty practice on your end.
What pisses me off about password restrictions is that they change and break my existing passwords.
Most recently, T-Mobile changed their shit to disallow some characters / reduce the length allowed, so my perfectly existing password was rejected as being "wrong", my account locked, and I had to fight with their customer service goons to g
Re: (Score:2)
Re: My issue with password restrictions (Score:2)
I hate the length limit too. I commented about how sometimes there is a length limit, but it happebs automatically, making your 80 character password 20 characters, and impossible to log in...
But it shouldn't even be a database issue. Unless I am mistaken, the length of hashes isn't (or at least doesn't have to be) dependent on the length of the input, so the database should store the same amount of information for "password" as for the entirety of beowulf...
Granted, that would take a lot longer for the has
Re: (Score:2)
I once asked a friend of mine, who is a professional ski boot fitter, what brands of hiking boots he recommends (he generally knows his stuff when it comes to performance footwear). His response was "buy a brand that makes shoes", meaning ONLY shoes/boots, not brands like North Face or Salomon.
If I asked my local butcher who I should get my bank account with I wouldn't be surprised if he said Tesco.
Re: (Score:2)
Bull. Totally wrong.
A good password could be made from real words as long as there are enough of them.
It's true that you want to pick from a larger dictionary rather than a smaller one. Perhaps you should estimate the entropy of a word by how common it is. What matters is total entropy not horrors like expecting users to remember misspelled words or strange symbols.
Re: (Score:2)
Better rules:
- It is not made up of real words in the dictionary
So something like correcthorsebatterystaple [xkcd.com] is a bad password now?
I said "like", actually using correcthorsebatterystaple is obviously a bad idea.
Re: (Score:2)