Tag Info

New answers tagged

0

I think 80 bits is just a reference to the general lower limit of what's considered computationally infeasible to brute force. From wiki: In 2002, distributed.net cracked a 64-bit key in 4 years, 9 months, and 23 days. As of October 12, 2011, distributed.net estimates that cracking a 72-bit key using current hardware will take about 45,579 days ...


0

Seems that most agree that regarding maths, Horse method is superior--to what extent seems to be mostly about limitations like how uniform the choices are, or what are these "easy to remember" or "easy to type" phrases. Fair enough, but I'll teach you a magic trick how to make these limitations a "bit" less relevant: Use Horse method as platform for ...


2

What matters is entropy. What makes a PRNG cryptographically secure is the inability of attackers to predict the next bytes. Precisely, there are three "security levels" that define the security, in the following model: The attacker is given s bits of consecutive output from the PRNG. The attacker's computing abilities are limited to 2k elementary ...


2

What should be the size of the seed that I initialize a CSPRNG with? Seed Length and other requirements for approved block cipher algorithms are summarized here: How often should I reseed it? The seed is secure as long as it remains unknown to the attacker. I think I can not explain better than this answer. CSPNRG entropy is calculated using ...


0

Here's a brute-force solution to the problem of brute force password cracking: Dedicate a few PCs to actually trying to crack passwords using the same (few) cracking tools that the attackers use. When a password is successfully cracked, send an e-mail politely informing the user that their password was detected to be too weak and requiring the user to change ...


1

I don't like password rules that have many, "this, but not that, one of these, but not too many of those" rules. Am I being too severe? I think so, here's why. I use 1Password. It generates random passwords for me. They look like this: luaD/fcr61nt7A%NxBCR NeTtVL7uuAqmL5_j&cm1 qwtlOjJsQor)9nM1%zl2 Some websites have rejected such passwords. ...


0

Again, I’m not an expert in information security by any stretch, but perhaps you could just encourage your users to use LastPass or Keeper to generate and store large (truly) random passwords for them, and store them in the secure vault? And to use 2-factor authentication too. I realize LastPass was recently hacked, but users that chose long, secure ...


3

Why don't you simply handle leetspeak-Words like regular ones? In your examples you say that you you accept GoodPassword4!, as it has more than one word (and Symbols and Numbers). So the implicit rule you seem to apply here is: “If you have to use a dictionary words, use more than just one (and also some Symbol and Number)”. I guess that's a rule ...


2

Ask your grandma (or any grandma within walking distance) to define a password. She'll have to follow the strict password rules (which you've printed out for her), but she's not allowed to talk to you. And it shouldn't take "too long". Also, tell her that she will need that password the following days/weeks (to use your web service), so she'll have to make ...


1

How about a middle ground? The rules you are giving basically say either long or hard with no middle ground. Instead, how about a graduated system: Assign a certain complexity per character and a certain multiplier for the various hard features. If that number is high enough you accept the password. Thus if you'll accept basically anything at 16 ...


-6

Apart from the issue of password strength, I tend to view those who use leetspeak as rather suspicious, so anyone who is using such a password on a site like the one that you describe is likely to be doing no good. For this reason it might be desirable to disallow leetspeak passwords. Of course, running passwords through a leetspeak filter has the added ...


19

Additional password rules should always be tempered with the following rule: "The more difficult it is to get a valid password and keep it current, the more likely people will write write them down in their day planners." Accordingly, your question is a social one. How much education regarding good password management can you provide versus how ...


37

The question was clarified in the comments to my other answer (which I'm leaving since it may still be helpful). It's really just asking about whether or not to allow leetspeak. Two factor authentication is already in use for high security areas. An index of entropy values: EQUIV MD5 ...


176

The mistake here would be to believe that extra password rules increase security. They do not. They increase user annoyance; and they make users choose passwords that are harder to memorize. For some weird psychological reason, most people believe that a password with non-letter symbols is "more secure" in some ontological way than a password with only ...


5

I'd say 8 is too low, even 9 is a order of magnitude more secure (literally) for something like this. You certainly want to consider 2-factor authentication given what this content is. Also, consider how people approach mandated things like capital letters (almost always the first character) and numbers (almost always the last character). These actually ...


9

If you aren't afraid of anyone stealing and brute forcing your passwords, then your most likely case of a password being discovered is a phishing attack. Password complexity requirements won't protect you from phishing attacks. If you use very complex passwords, users will find a password that works and stick with it, when it expires, they will make the ...



Top 50 recent answers are included