A passphrase is a longer password that typically consists of multiple words.
25
votes
2answers
2k views
Pre-hash password before applying bcrypt to avoid restricting password length
Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
7
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
2
votes
4answers
390 views
passphrases - lowercase and dictionary words
Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
8
votes
5answers
883 views
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
I'm trying to figure out the best practices for accessing my devbox from a public terminal.
Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
10
votes
4answers
400 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
