New answers tagged

0

Ok, here is my opinion. Using Keepass(or any password manager) you could generate a random password like this "CslmHD5Rh6" This is a fairly secure password. According to grc haystack the chances of breaking this password would be 1 in 853,058,371,866,181,866. The only way to break this would be with the hash of the password which if they were able to get the ...


2

This is really bad advice I concur with the general consensus. But, the target audience for this advice is people who use passwords like password123 or il0vecarr0ts so this will improve their passwords, albeit with a flawed password...but less flawed. Which is a good thing. Also the risk of what you are protecting has to be considered, for example if a 14 ...


5

To play devil's advocate, this technique can be used if you end up with a long enough password (you may want to use two lines for this). And it is definitely an improvement if your old password is harry1990 or qwerty123. However, this technique is (a) overly complex, and (b) the resulting password is sub-optimal. I believe this famous XKCD comic best ...


3

In a word, no. It is extremely stupid. Anything that reduces the search space for attackers is insecure. Don't do this. Somebody should hold the BBC to account for this.


3

Use a password manager. A very popular password manager among the technocrati is KeePass. My IT manager says "LastPass for the babies" (implying that its easiest). edits: link removed due to objections to article's credibility. Direct answer added by request. As for the question, I'll say it's good (but not great) advice. There's definitely worse ...


3

No. It isn't good advice on creating a password. I can't really see any specific advantage to the password method at all. It's easier to guess because it likely uses a common phrase (remember, as criminals we're trying to crack as many passwords in the database as possible, not one specific one. Yes you might use an obscure phrase, but I'll bet the majority ...


3

The short answer is "no". This article by Jeff Atwood makes are fairly good case for any password of less than 12 characters being insecure. Summary: the above is fine for the someone-trying-passwords scenario (~1000 guesses per second), but so would just using the phrase "If I was your boyfriend, I'd never let you go" as your password. Most people have so ...


9

Like most things in security, it depends on what you're trying to protect, and who you're trying to protect it from. Short answer is: For logging into most websites, it's likely secure for attackers trying to guess passwords by trying multiple logins. For any scenario where an attacker can perform an offline attack this is unlikely to be a good method ...


80

It's horrible :) To provide some numbers to back claims by other answers: This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits per year! Average word count for a song is 300-600, depending on the style, and they do 7-10 words per sentence (And I imagine that's the comfortable length of a ...


4

Humans are indeed very predictable, a lot more so than we usually think we already are, see e.g. here. So, you should never choose your passwords using a scheme that involves meaningful information to you.


7

In a world where people very frequently disclose information on social media about their favorite musical artists, songs, genres, and even specific favorite lyrics, is this a good password strategy to use? Umm... no. Will it withstand a simple guessing attack using, say, 500 very frequently-used passwords? Sure. (Unless the dictionary creator was wise to ...


3

Considering most people would likely pick a popular song's chorus (especially since you want 'the catchier the better') and only change letters like E and A to 3 and 4 respectively, it wouldn't be beyond the bounds of reason to generate a wordlist from popular songs in this manner with relative success.


7

Passwords length is more important than complexity when it comes to security. 1Iw&iNLy3 so this password has 9 characters which is quite low and can be cracked in a matter of time. So, when trying to increase the strength of your passwords/pass-phrases, my advice is to consider length as much or more than you consider complexity. Make your admin and ...


142

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method. This is a good question, and I'm going to depart from the norm ...


26

It is more secure than what most people are doing, which is to use one dictionary words. The BBC's method starts with one or two sentence, instead of just a word. However, it is less secure than what it could have been. First, if you're using a well known chorus, you're increasing the chance of other people having similar passwords to you. Second, ...


1

Doing the math your password gets more secure (higher entropy) if its longer not more complex. Ideally it is long and complex but who can remember that. So there is always a trade-off between usability and security. Here is are two good blog posts which discuss that in detail: https://pthree.org/2011/03/07/strong-passwords-need-entropy/ ...


11

yes its not bad advice though it depends how strongly people follow it, unlike your self I wouldnt slam my favourite artist out there (we all know you like JB..) following this advice would most likely make many pick their FAVOURITE artist and their FAVOURITE song and most likely the chorus or very well known line (the ones you sing along to and do not ...


2

You are looking for a MDM (Mobile Device Management) solution: Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile ...


0

This seems weak protection for something as important as a password. Your solution is based on the assumption that just because you are the only user on your computer, everything that you execute is trusted. Unfortunately, this is not the case. Windows User Account Control was created to help protect against the running of malicious code. But the random ...


2

The logical flaw in the scheme is that you need to know the password in order to access the password. This nullifies any valid use for storing the password in the first place. So, it's not so much a paradox as a fallacy. If your real goad is simply to store a password as securely as possible, then your architecture generally makes sense, but replace ...


1

This can actually be done, in most cases at least (of course, that doesn't necessarily mean it's a good idea!): You're right that it is effectively impossible to recover the user's previous password from the stored password hash. But you don't need to: as part of the password-change process, it's normal to ask for the user's old password, and to check it. ...


3

It is straightforward to prevent the specific problem of user's updating new passwords that are too similar to previously used passwords (e.g., only a single digit/character changes). On the same password change screen, simply require the user to enter their old password, as well as their requested new password. It is good practice anyway to require users ...


5

Easy enough: You have a prospective password of "password1". Test "password" and "password0" to see if they work with the old hash. There's no need to see the plaintext of the old password for this to work. However, this isn't going to work for the reasons Steve Sether lays out.


-3

One of the biggest security worry on this is the fact that you're storing the passwords in plaintext if you can distinguish between a single character differences. Firstly, you should look into storing these passwords as a one way hash, simply because the password storage could potentially be vulnerable to attack. After that, you could implement a mechanism ...


5

This has been discussed at various points, and most discussions seem to come back to the concept of password topologies - the patterns which lots of passwords have. There is a good OWASP presentation on YouTube, which suggests that a lot of passwords which have to follow complexity rules follow similar patterns: Password1! - If you enforce at least one ...


34

You can't. Your users are doing this because the reset mechanism has become obtrusive to them getting work done. People are clever enough to get around any of the mechanisms you're going to devise. Those that aren't will quickly learn from those that are. Information like this travels fast. If you somehow were to figure out how to counter the password1 ...


2

This is kind of tricky. Its easy to enforce complexity because complexity is relativley easy to discribe but a complex password is in many cases not a good one. For example if your policy forces a min. length of 10 characters, a special char, a number and upper and Lower cases many people will do this: David1989$ Which is the first Name, the year of birth ...


2

From the comments, it sounds like the core question is, and please do comment if I'm wrong here: "We have a centralised authentication provider (LDAP) and multiple applications which end users authenticate against this. Is there a way of making it so that if the user changes their password on one of these applications, the change can automatically be applied ...



Top 50 recent answers are included