0
votes
4answers
78 views

How long does a passphrase have to be to be as secure as a random collection of letters, digits, punctuation, etc.?

If one uses a passphrase which is grammatical, such as "I put my keys under the doormat because they're safe there."... how many words (on average) must it contain to be as secure as a password with ~ ...
3
votes
2answers
192 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
1
vote
1answer
128 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
0
votes
2answers
66 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
4
votes
2answers
564 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
1
vote
0answers
47 views

How can I recover the password of a TrueCrypt vlume? [duplicate]

I am trying to recover the password of a trucrypt volume. It is composed by a combination of 4 words (one invented). I remember 3 of them but not their order. Do you know any tools that cold help me ...
2
votes
1answer
192 views

How vulnerable are passphrases with grammatical structure?

Imagine I create a passphrase using random dictionary words but a common grammatical structure (eg: article, noun, verb, adjective, noun). Given a pretty small dictionary of 5000 words, how vulnerable ...
3
votes
3answers
948 views

What should I do if I type my password in the address bar, or type password in google search?

When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do? username text box address bar Google search What do you suggest, ...
-2
votes
6answers
683 views

Are passwords made up from concatenating a few foreign words better than shorter random characters?

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
7
votes
4answers
378 views

Will passphrases always be secure?

In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
13
votes
1answer
4k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
2
votes
4answers
530 views

passphrases - lowercase and dictionary words

Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
6
votes
2answers
769 views

How should I make diceware passphrases more memorable?

I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
35
votes
2answers
4k views

Pre-hash password before applying bcrypt to avoid restricting password length

Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
9
votes
4answers
498 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...