Bad Grammar Makes Good Passwords

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Researchers are saying that bad grammar actually makes good passwords. If that is true, most of our passwords should be impossible to crack. ;)

As processing power continues to fall in price, choosing passwords that are easily memorized but secure is getting harder and harder. A $3000 computer running appropriate algorithms can make 33 billion password guesses every second.
Click to expand...
 
Oh god. Steve take this down NOW!

My IT dept. is now going to require new passwords every 180 days that not only are only 6-12 characters, have a caps char, a number, a special char, not a repeat of the last dozen passwords...but now poor grammar as well.
 
$3000 computer running appropriate algorithms can make 33 billion password guesses every second
Click to expand...

Wait..what. It takes several video cards and a 6x core intel to crack 9000 wpm just for WPA. What do they know that i don't.

I mean well, i have no idea what they're talking about.
 
I might change my passwords to "1o1 ull never gess this p@$$w0rd nubs u f@il!"
 
Azhar said:
I might change my passwords to "1o1 ull never gess this p@$$w0rd nubs u f@il!"
Click to expand...

Sorry, the password you entered is over the 12-character limit for passwords. Please try again.
 
Skripka said:
Oh god. Steve take this down NOW!

My IT dept. is now going to require new passwords every 180 days that not only are only 6-12 characters, have a caps char, a number, a special char, not a repeat of the last dozen passwords...but now poor grammar as well.
Click to expand...

I have never understood the value of changing passwords often - unless someone is trying day after day to crack yours AND you know you are changing to something already tried.....

My passwords are gibberish combinations of letter, numbers and characters, typed randomly, then I go in and make specific changes to eliminate any standardization from that. Throw in a few capitals and an underscore or two and I have yet to have one be cracked.

I don't try to remember them - I keep them in a simple text files in a hidden, encrypted folder that closes by itself after a few minutes open. And that is just for common message board sites. Financial sites passwords are never saved on a computer.
 
HalOfBorg said:
I have never understood the value of changing passwords often - unless someone is trying day after day to crack yours AND you know you are changing to something already tried.....
Click to expand...

This is why I don't understand why more sites don't have secondary confirmation. At a business they just need to call your desk phone with a confirmation you type in appended to your normal password. Worse yet they go to an RSA or test message method. Either one allows the user to have a unique and moderately complex password with something a hacker will RARELY have.
 
What computer will let you try passwords that often?

The only way they are ever going to get in is if the system is setup very insecurely. i.e., have a password that doesn't lock out. and even then, it is going to have to wait a second or two at the minimum between login attempts.

Sure for personal computers with just an admin account setup, they might be able to get it. It is still going to take a while if you have a decent password though.

As for web sites, message boards, etc. They only allow so many login attempts before locking out.
 
Skripka said:
Oh god. Steve take this down NOW!

My IT dept. is now going to require new passwords every 180 days that not only are only 6-12 characters, have a caps char, a number, a special char, not a repeat of the last dozen passwords...but now poor grammar as well.
Click to expand...

My last job required that. Crazy ass grammatical requirements on all passes. No two letters together, no similarly placed in the alphabet repeated x times, etc.

It took me 2 days to figure out a password that would fit the requirements.
 
Parja said:
Maybe try following the link?

http://whitepixel.zorinaq.com/

Quad 5970s brute forcing single hash MD5.
Click to expand...

The real problem is idiot developers still using general purpose hashing algorithms such as MD5 or SHA-1 for passwords. Hell, weaknesses in MD5 were discovered as far back as 1995. I use at minimum bcrypt for all passwords in my work. What's really sad though is developers not even bothering with password security at all. At my current job, I rebuilt a website that was storing passwords in plain text, and the login process was not SSL secured. Not to mention, all of the passwords were the persons last name plus a random 2 digit number. Whoever did that should never write a single line of code ever again. That's just flat out laziness.
 
cyclone3d said:
What computer will let you try passwords that often?

The only way they are ever going to get in is if the system is setup very insecurely. i.e., have a password that doesn't lock out. and even then, it is going to have to wait a second or two at the minimum between login attempts.

Sure for personal computers with just an admin account setup, they might be able to get it. It is still going to take a while if you have a decent password though.

As for web sites, message boards, etc. They only allow so many login attempts before locking out.
Click to expand...

Any decent website won't let you attempt passwords that often. Most of the brute force attacks I've seen are against the database itself, after someone has obtained a copy. Some would argue that once you have the database, knowing the passwords is pointless. True, depending on what the hacker is trying to gain access to. Considering most people reuse the same password for everything, if you have a database full of email addresses and passwords, you can attempt to log into their email accounts, and from there you can easily gain access to all of their accounts, including bank accounts. That's also why I use a unique password for my email that isn't shared anywhere else.
 
When I see articles on password strength, I'm always reminded of this:

password_strength.png
 
Humans are actually very good at making names to assemble seemingly random letters; they're memorable and easily typed. But a computer will probably not crack them, unless I'm totally wrong.

If the software can crack VandenDriessche or Krzyzewski, then bravo, it wins. Or a place such as Ljubljana or Albuquerque.

Or do something easy for your mind to solve like Elvis_Baratheon, both kings, or two wizards, two Jedi knights, etc.
 
singe_101 said:
Humans are actually very good at making names to assemble seemingly random letters; they're memorable and easily typed. But a computer will probably not crack them, unless I'm totally wrong.

If the software can crack VandenDriessche or Krzyzewski, then bravo, it wins. Or a place such as Ljubljana or Albuquerque.

Or do something easy for your mind to solve like Elvis_Baratheon, both kings, or two wizards, two Jedi knights, etc.
Click to expand...

VandenDriessche and Krzyewsky can indeed be easily cracked by a computer. They aren't long enough. You're assuming that the computer is only using a dictionary to try and crack the password, we have enough computing power today that you don't need to rely on a dictionary and can simply use the entire character set. Read the comic that Geryon posted and you'll understand why having a longer password is better than a short, but "complex" password.

Frankly, I hate lame max password length requirements. The minimum acceptable max length should be 32, so allowing 8-32 character passwords. I still see requirements of 8-12 and typically 8-16 at best.

Also, without a periodical password reset, all the dumbdumbs end up doing is using "password1" or "Password1" in place of the old standby of "password".
 
Something along the line of "Grandmatik mach fried" might do it...
 
How would someone be able to make 1000 guesses/second fo days? Just if there's no lockout at all?
 
I play piano, and my passwords are just 5 seconds of classical music played on a keyboard with unexpected finger positions.

I wouldn't recognize my passwords if i saw them, but they usually contain around 40 characters.

Too long for my bank :(
 
You must log in or register to reply here.
Back
Top