A passphrase is a longer password that typically consists of multiple words.
1
vote
1answer
61 views
What is the entropy of just 1 Diceware passphrase like my passphrase?
A 5-word Diceware passphrase gives an entropy of 7776^5 = 3E19 = 19 Bans (or ~64 bits). Apparently monster cracking systems can currently guess passphrases for MD5 at a rate of 180 billion/sec (2E11). ...
-1
votes
1answer
107 views
GPG Passphrase Forgotten - Need Professional Help [closed]
I forgot a passphrase after not using it for a long time but I remember the kind and number of characters probably used. I guess that some brute force trial could work. Is any programmer reading this ...
3
votes
2answers
131 views
Computing entropy for a passphrase ( minimal word length … )
Edit: 2013-05-17
After reading first answer from Tom Leek and some docs around the web, I've begin to write some options to my tool genpassphrase.pl:
$ ./genpassphrase.pl -h
Usage: genpassphrase.pl ...
2
votes
1answer
101 views
How vulnerable are passphrases with grammatical structure?
Imagine I create a passphrase using random dictionary words but a common grammatical structure (eg: article, noun, verb, adjective, noun). Given a pretty small dictionary of 5000 words, how vulnerable ...
3
votes
3answers
264 views
How to use USB-Stick instead of passphrase?
I wanted to know if something exists that would allow the following.
Whenever I use my RSA key(when using ssh for example) I'm prompted for my passphrase. I would like to, instead of being prompted ...
3
votes
2answers
106 views
Is a random keyfile more secure than a derived key?
I'm devising an encryption layer for some proprietary cloud storage API. Basically this should act as a transparent adapter that encrypts whole binary blobs (files) on upload and decrypts them on ...
1
vote
2answers
333 views
What should I do if I type my password in the address bar, or type password in google search?
When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do?
username text box
address bar
Google search
What do you suggest, ...
8
votes
5answers
901 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
-2
votes
6answers
337 views
Are passwords made up from concatenating a few foreign words better than shorter random characters?
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
...
4
votes
3answers
2k views
What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?
I'm looking at two comprable pieces of software which need to encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds ...
6
votes
2answers
429 views
Would an unnecessarily long password degrade performance of a WPA2 wireless network?
My friend wants to keep his home network super-secure, due to some trouble that he's had with unwelcome Wi-Fi intruders. So, naturally, he devised an ultra-long WPA2 passphrase (on the order of 100+ ...
7
votes
4answers
299 views
Will passphrases always be secure?
In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
7
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
2
votes
4answers
393 views
passphrases - lowercase and dictionary words
Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
5
votes
2answers
549 views
How should I make diceware passphrases more memorable?
I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
25
votes
2answers
2k views
Pre-hash password before applying bcrypt to avoid restricting password length
Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
10
votes
4answers
401 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
