• (disco) in reply to boomzilla
    boomzilla:
    I currently have 142 entries in KeePass. Some of those will probably not be used, but some I don't use for several years.

    I only have a little over 50, but there is no way I could possibly remember strong, unique passwords for all those sites.

  • (disco) in reply to boomzilla
    boomzilla:
    I currently have 142 entries in KeePass. Some of those will probably not be used, but some I don't use for several years. Not to mention differing user names. Ugh.

    (KeePassX 0.4.3 on windows for me, along with the mac and droid versions)

    357 entries with 44 unique usernames. And yeah, a number of those logins are dead (past jobs, etc)

  • (disco) in reply to accalia
    accalia:
    given sufficient computing power even a good master password can be broken.
    flabdablet:
    So you pick a master password **long and random enough** that acquiring sufficient computer power to break it would take longer than the remaining lifetime of the Sun; anything over 120 bits is plenty. Ça plane pour moi.

    Emphasis mine.

    Reference: https://www.grc.com/haystack.htm

    Section on:

    Which of the following two passwords is stronger, more secure, and more difficult to crack?

    F0x.....................

    PrXyc.N(n4k77#L!eVdAfp9

    accalia:
    my trust in the security of my password store is inversely proportional to the distance that password store is from me. ... given that statement, logically if the distance from me is zero (my password store is me) my trust in it is infinite.

    Too bad my users can't be more like you...

  • (disco) in reply to aliceif
    aliceif:
    I never knew any of my cell phone numbers - always had to look them up. Still don't, actually.

    Takes me months to memorize my number when I get a new one, but only a few days to learn my wife's when hers changes. Difference? I don't call myself nearly as often as my wife.

  • (disco) in reply to dcon
    dcon:
    357 entries with 44 unique usernames
    I think that's impressive? I have four passwords, the 8-character-maximum-insecure one, the 9-character-semisecure one (for those sites that don't accept certain special characters), the 10-character-secure-2014 one (for sites I created an account on pre-2015) and the 10-character-secure-2015 one (for sites I joined in after 2014). I have three unique usernames, the 8-character one (for when you can't have a 9-character username), the 9-character-lowercased on (for sites that don't allow capitalized usernames), and the 9-character one (for everything else).

    To date, the only sites that have given out my password to crackers are Yahoo and Skype (it was the 8-character-maximum-insecure one both times, from 2008 and 2013, respectively).

    Then again, apparently my accounts aren't all that high-profile....

  • (disco) in reply to redwizard
    redwizard:
    Takes me months to memorize my number when I get a new one, but only a few days to learn my wife's when hers changes. Difference? I don't call myself nearly as often as my wife.

    That's another nice thing about using KeePass: my master password is long and ridiculous, but because I use it every time I start a work session that involves logging on to anything, my fingers remembered it quickly and are now not going to let go of it.

    I just counted the entries in my database and there are 165 sets of credentials in there. All the passwords are long, machine-generated random, and unique. Some of them get used once per year or less, but when I need them I really need them, and I love knowing that when I do, I'll just have them.

    I also used to do the tiered-security-level shared password thing across multiple sites. IIRC it took me two years after finding out that password safes were a thing before I committed to using one. I have never had cause to regret it since.

  • (disco) in reply to flabdablet
    flabdablet:
    IIRC it took me two years after finding out that password safes were a thing before committing to using one. I have never had cause to regret it since.

    :+1: I don't remember if it took me two years, but it was definitely a while, and it was reading about security :wtf:s here that convinced me.

  • (disco) in reply to redwizard
    redwizard:
    Which of the following two passwords is stronger,more secure, and more difficult to crack?

    F0x.....................

    PrXyc.N(n4k77#L!eVdAfp9

    zxcvbn rates the estimated crack times for those two as "instant" and "centuries" respectively.

  • (disco) in reply to flabdablet

    interestingly..... https://howsecureismypassword.net/ rates

    flabdablet:
    F0x.....................
    at 50 octillion years and
    flabdablet:
    PrXyc.N(n4k77#L!eVdAfp9
    at 30 octillion years

    ..... :wtf:

  • (disco) in reply to accalia

    That's because you don't mess with the Fox!

    Filed under: May be prudent to leave the hedgehog alone too.

  • (disco) in reply to EatenByAGrue

    I see your ASCII delimiter-separated file and raise you an EBCDIC fixed-width file with 4 bytes for each password.

  • (disco) in reply to accalia

    https://imgs.xkcd.com/comics/security.png

  • (disco) in reply to ben_lubar

    It seems to me that the scenario outlined* in this cartoon is many orders of magnitude less unlikely than the one where somebody finds their way into my Dropbox and decrypts my passwords database without my knowledge.

    accalia:
    30 octillion years

    howsecureismypassword.net is probably using a naive estimator based on nothing more than length and detected alphabet size. Corresponding estimates from zxcvbn, which also attempts to model the effects of dictionary and pattern attacks, are 24 seconds and 1.4 octillion years respectively.

    I am completely unsurprised to see Steve Gibson making recommendations based on a relatively shallow understanding of his claimed field of expertise. That man is a walking demonstration of Dunning-Kruger.

    *see what I did there?

  • (disco) in reply to flabdablet 
    password:	lojban gismu
entropy:	57.319
crack time (seconds):	8986022781384.37
crack time (display):	centuries
score from 0 to 4:	4
calculation time (ms):	1

    Somehow, I don't think two words is a very secure password.

    password:	jbojevysofkemsuzgugje'ake'eborkemfaipaltrusi'oke'ekemgubyseltru
entropy:	302.857
crack time (seconds):	7.38156134403456e+86
crack time (display):	centuries
score from 0 to 4:	4
calculation time (ms):	15

    Seriously? A correctly-spelled one-word password takes over 1069 times the age of the universe to guess?

  • (disco) in reply to ben_lubar

    I just know I'm going to regret asking this question.

    Does lojban permit the construction of compound words of arbitrary length? If so, then your single word example is probably best thought of as a passphrase. Also, zxcvbn probably doesn't include a lojban dictionary, so its entropy estimate of 303 bits is probably a little generous. Here's an English passphrase of similar length for comparison purposes:

    password:     thiscompulsiontoexplaintheobviousisprobablyunhealthyforbothofus
entropy:     88.047
crack time (seconds):     1.598157920610293e+22
crack time (display):     centuries
score from 0 to 4:     4
calculation time (ms):     10

match sequence:

'this'
pattern:     dictionary
entropy:     3.8073549220576037
dict-name:     english
rank:     14
base-entropy:     3.8073549220576037
upper-entropy:     0

'compulsion'
pattern:     dictionary
entropy:     14.088291357347819
dict-name:     english
rank:     17418
base-entropy:     14.088291357347819
upper-entropy:     0

'to'
pattern:     dictionary
entropy:     1.5849625007211563
dict-name:     english
rank:     3
base-entropy:     1.5849625007211563
upper-entropy:     0

'explain'
pattern:     dictionary
entropy:     9.264442600226602
dict-name:     english
rank:     615
base-entropy:     9.264442600226602
upper-entropy:     0

'the'
pattern:     dictionary
entropy:     2
dict-name:     english
rank:     4
base-entropy:     2
upper-entropy:     0

'obvious'
pattern:     dictionary
entropy:     10.20945336562895
dict-name:     english
rank:     1184
base-entropy:     10.20945336562895
upper-entropy:     0

'is'
pattern:     dictionary
entropy:     3.5849625007211565
dict-name:     english
rank:     12
base-entropy:     3.5849625007211565
upper-entropy:     0

'probably'
pattern:     dictionary
entropy:     8.224001674198107
dict-name:     english
rank:     299
base-entropy:     8.224001674198107
upper-entropy:     0

'unhealthy'
pattern:     dictionary
entropy:     13.077316445881026
dict-name:     english
rank:     8643
base-entropy:     13.077316445881026
upper-entropy:     0

'for'
pattern:     dictionary
entropy:     4.08746284125034
dict-name:     english
rank:     17
base-entropy:     4.08746284125034
upper-entropy:     0

'both'
pattern:     dictionary
entropy:     8.247927513443585
dict-name:     english
rank:     304
base-entropy:     8.247927513443585
upper-entropy:     0

'of'
pattern:     dictionary
entropy:     3.1699250014423126
dict-name:     english
rank:     9
base-entropy:     3.1699250014423126
upper-entropy:     0

'us'
pattern:     dictionary
entropy:     6.700439718141092
dict-name:     english
rank:     104
base-entropy:     6.700439718141092
upper-entropy:     0
  • (disco) in reply to flabdablet
    flabdablet:
    Does lojban permit the construction of compound words of arbitrary length?

    Yes, but jbojevysofkemsuzgugje'ake'eborkemfaipaltrusi'oke'ekemgubyseltru is in the dictionary.

  • (disco) in reply to ben_lubar

    General principle: using any kind of pattern to generate your passwords will vastly reduce their expected crack times. For any given password length, the output of a CSPRNG will be far stronger than anything a human could generate unaided.

  • (disco) in reply to flabdablet

    I have a password consisting of four uncommon words (>5 letters each) that I use for Google, combined with 2-factor authentication. Everything else is either 63 random ASCII printable characters or as many of them as I can get the form to accept and is remembered by Chrome.

  • (disco) in reply to ben_lubar
    ben_lubar:
    jbojevysofkemsuzgugje'ake'eborkemfaipaltrusi'oke'ekemgub'yseltru is in the dictionary

    Just not in zxcvbn's; which goes to show that password strength estimators are only ever really useful for telling you that your password might be unexpectedly weak. If you want strong, you really do have to rely on raw length and the soundness of your RNG.

    I am quite sure that somebody will end up paying the smartarse tax for this one too:

    password:     Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch
entropy:     234.644
crack time (seconds):     2.1565495028368197e+66
crack time (display):     centuries
score from 0 to 4:     4
calculation time (ms):     17
  • (disco) in reply to flabdablet

    lojban has more entropy than Welsh?

  • (disco) in reply to ben_lubar

    Once your password is being attacked by an instance of John the Ripper incorporating both Welsh and Lojban dictionaries: not noticeably.

    password:     Pneumoultramicroscopicsilicavolcanoconiosis in Llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch
entropy:     373.094
crack time (seconds):     1.0270597775302939e+108
crack time (display):     centuries
score from 0 to 4:     4
calculation time (ms):     17
  • (disco) in reply to flabdablet 
    Password                               Seconds to crack
poop                                            0.024
pooppoop                                        0.153
pooppooppoop                                   74.188
pooppooppooppoop                              466.040
pooppooppooppooppoop                       226495.659
pooppooppooppooppooppoop                  1422821.494
pooppooppooppooppooppooppoop            691491246.011
pooppooppooppooppooppooppooppoop       4343874020.724

    MOST SECURE PASSWORD EVER

  • (disco)

    Related anecdote: I was at a bank today and the banker insisted that I should put a "security question" on my account just in case I needed to withdraw money by phone. Why is it that the system handling the entire world's wealth is many orders of magnitude less secure than the system handling video games and conversations between nerds?

  • (disco) in reply to ben_lubar

    Banks have no interest in security beyond pricing the aggregate effect of breaches to an acceptably low level. Nerds care more about means than ends; for nerds, security is a branch of aesthetics.

  • (disco) in reply to ben_lubar

    Someone try to crack password "Dot............doT" (there is 12 "." in between)

  • (disco) in reply to cheong

    zxcvbn analysis:

    password:     Dot............doT
entropy:     31.618
crack time (seconds):     164799.36
crack time (display):     3 days
score from 0 to 4:     2
calculation time (ms):     12

match sequence:

'Do'
pattern:     dictionary
entropy:     5.584962500721157
dict-name:     english
rank:     24
base-entropy:     4.584962500721157
upper-entropy:     1

't'
pattern:     bruteforce
entropy:     6.409390936137703
cardinality:     85

'............'
pattern:     repeat
entropy:     8.62935662007961
repeat-char:     '.'

'do'
pattern:     dictionary
entropy:     4.584962500721157
dict-name:     english
rank:     24
base-entropy:     4.584962500721157
upper-entropy:     0

'T'
pattern:     bruteforce
entropy:     6.409390936137703
cardinality:     85
  • (disco) in reply to redwizard

    TRWTF is changing your phone number so often it becomes a problem. I've had the same number I got when I was 16 and I've changed providers a couple of times since.

  • (disco) in reply to Tsaukpaetra
    Tsaukpaetra:
    I have three unique usernames, the 8-character one (for when you can't have a 9-character username), the 9-character-lowercased on (for sites that don't allow capitalized usernames), and the 9-character one (for everything else).

    Is "Tsaukpaetra" the 8 or 9 character one? :trollface:

  • (disco) in reply to flabdablet

    Thanks.

    I heard each punctuations are treated as seperate entities when performing dictonary attacks, and therefore will create trouble for them. Guess this way is no longer good enough.

    How about non-English passwords? "鑫森淼焱垚"

  • (disco) in reply to obeselymorbid
    cheong:
    non-English
    obeselymorbid:
    Is "Tsaukpaetra" the 8 or 9 character one?
    The 9-character one, because ꜷ and æ are one character each. :P :P :stuck_out_tongue:
  • (disco) in reply to cheong
    cheong:
    How about non-English passwords? "鑫森淼焱垚"
    ``` password: 鑫森淼焱垚 entropy: 25.222 crack time (seconds): 1956.77 crack time (display): 34 minutes score from 0 to 4: 1 calculation time (ms): 1

    match sequence:

    '鑫森淼焱垚' pattern: bruteforce entropy: 25.22197059679227 cardinality: 33

    <a href="https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html">Play with zxcvbn yourself</a> if you're interested in testing others. It's a local js library that needs no network access once loaded, so the passwords it tests never leave your browser. The <a href="https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/">writeup</a> explains the algorithm, the rationale, and the way you can use it on your own sites.
  • (disco) in reply to flabdablet

    Nice. Thanks.

    I've got easy-to-remember password that seems to be secure, do I win a prize? :stuck_out_tongue:

    password: q.w.e.r.t.y entropy: 59.3 crack time (seconds): 35494227657132.74 crack time (display): centuries score from 0 to 4: 4 calculation time (ms): 0

  • (disco) in reply to ben_lubar
    ben_lubar:
    MOST SECURE PASSWORD EVER

    Only for the anally-retentive. Beware!

  • (disco) in reply to flabdablet

    Reading the introduction page there...

    Btw, most password checker see "correcthorsebatterystaple" as weak password because it fails dictionary attack pretty easily. By tokenizing the string, it gives 4 element only, and surrender in (171476 ^ 4) attempts over common dictionary attack.

  • (disco) in reply to redwizard
    redwizard:
    aliceif:
    I never knew any of my cell phone numbers - always had to look them up. Still don't, actually.

    Takes me months to memorize my number when I get a new one, but only a few days to learn my wife's when hers changes. Difference? I don't call myself nearly as often as my wife.

    Like you, I never call my own number, but for me it was the opposite when it last changed (about five years ago). I still don't remember hers, because *I always call it from my phone's contact list*, while I give mine out almost every week to the delivery service at my local Carrefour so they can find my address etc.

    And to the other poster, yammering on about having the same number since the age of 16, that's nice, but some of us are old enough (and have moved internationally enough) that this wouldn't work.

    I was 16 in 1982, ffs, and I don't recall there being any "carry your phone number around with you forever" services in 1982, and if there were, they wouldn't have allowed me to keep a number across an international move, which I've done twice since then.

  • (disco) in reply to abarker
    abarker:
    Who needs tea?

    Aliens from the planet we come from.

    Btw, thanks for sharing your Internet with us.

  • (disco)

    71828182845904523536028747135266249775724709369996

    is considered extremely secure by some online checkers and extremely weak by others. But only because there are only numbers in it, not because it is the first 50 decimals of one of the most used number in the world.

    2.71828182845904523536028747135266249775724709369996

    is about the same.

  • (disco) in reply to Eldelshell

    If you thought i<3tswift was the joke, you should google for hunter2 and update your meme-knowledge.

  • (disco) in reply to YellowOnline
    YellowOnline:
    If you thought *i<3tswift* was the joke, you should google for hunter2 and update your meme-knowledge.

    To be fair, i<3tswift is definitely a joke.

  • (disco) in reply to antiquarian
    antiquarian:
    To be fair, i<3tswift is definitely a joke.

    But definively a rather safe password for nerd usage, nevertheless.

  • (disco) in reply to cheong
    cheong:
    171476 ^ 4

    You are aware that that is (just under) 1021, yes? At 1012 tests per second (i.e., a big cluster of zombies machines dedicated to beating this one password) the expected time to crack it is 15 years.

    Your laundry list is going to be safe…

  • (disco) in reply to dkf

    To be fair, the expected time to crack this particular passphrase is probably a nanosecond...

  • (disco) in reply to Maciejasjmj

    Well, slightly longer. They'll probably check password and hunter2 first…

  • (disco) in reply to cheong
    cheong:
    most password checker see "correcthorsebatterystaple" as weak password because it fails dictionary attack

    Actually, most password strength estimators severely down-rate correcthorsebatterystaple for no better reason than that it contains nothing but lowercase letters; you can verify this by observing that a truly strong password like kfczpxudhkmwtwyehgngnaxpu scores a similarly low rating from the same estimator.

    The zxcvbn estimator correctly treats it as more likely to fall to a dictionary attack than anything else, and estimates entropy accordingly. Scroll down on the demo page and you'll see both the xkcd passwords analyzed under "Examples".

  • (disco) in reply to flabdablet
    flabdablet:
    "Examples"

    password: neverforget13/3/1997

    What happened on Smarch 3rd 1997?

  • (disco) in reply to hungrier

    I dunno, pastille day or some bullshit.

  • (disco) in reply to Steve_The_Cynic
    Steve_The_Cynic:
    I was 16 in 1982,

    Kids these days, sheesh!

    Filed under: Get off my lawn!

  • (disco) in reply to dkf

    Regarding this, if the attacker has that many machine on hand, he can just build a precomputed hash network and send any password he havested to the zombie that holds corresponding hash to that segment.

    Not sure how it can be done, but with Google's search speed for 4 words query, if someone do it in the right way, I assume it's going to be fast.

  • (disco) in reply to cheong

    You might want to read up on salting, which exists specifically to make precomputed hashes useless.

  • (disco) in reply to flabdablet

    There's a finite number of possible passwords that will fit in memory, even with salts added on. You just need a larger password database. Once you have a password for each hash, you've won.

Leave a comment on “What's The Password?”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article