1,434 reputation
816
bio website
location
age
visits member for 3 years, 3 months
seen May 20 '12 at 21:36

Aug
29
awarded  Commentator
Aug
29
accepted Pre-hash password before applying bcrypt to avoid restricting password length
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
... and luckily (or by design?) 64 or 128 bits (8 or 16 characters) of random salt with the 256 bits (32 characters) sha256(password) output does fit within the 55 char bcrypt() limit. Thanks.
Aug
29
comment Pre-hash password before applying bcrypt to avoid restricting password length
Thanks, now fixed
Aug
29
revised Pre-hash password before applying bcrypt to avoid restricting password length
edited body
Aug
25
asked Pre-hash password before applying bcrypt to avoid restricting password length
Aug
25
awarded  Teacher
Aug
25
answered How to best set up public WiFi without giving access to the rest of my network?
Aug
24
comment Best password strength checker
How secure...: plain & initial-cap = instant ("in top 6910"), i->1, s->5 = 1 year, +& = 928 years, +&3 = 71K years. How secure... also uses a wordlist but doesn't use it to reduce its entropy estimate as such, and l33t-speak defeats it. It doesn't use diagraph-frequences so words score the same as alpha-gibberish the same length.
Aug
24
comment Best password strength checker
Rumkin.com: plain = 29.9b ("common password!"), initial-cap = 36.3b ("common password!"), i->1 = 38.7b, s->5 = 38.1b, +& = 43.1b, +&3 = 46.7b. Rumkin uses a wordlist to detect "common passwords", BUT it doesn't reduce the entropy as a result. It does use character digraphs to estimate the entropy (based on English digraph frequencies), which will compensate for that to some extent. However, it doesn't take l33t-speak substitutions into account for either the "common word" or digraph frequency estimates.
Aug
24
comment Best password strength checker
As a simple test, lets try some variations of "christmas" (plain lower case, initial cap, i->1).
Aug
23
revised How reliable is a password strength checker?
corrected and elaborated entropy calculation for password and passphrase
Aug
23
revised How reliable is a password strength checker?
caveat on article reference
Aug
23
suggested suggested edit on How reliable is a password strength checker?
Aug
23
suggested suggested edit on How reliable is a password strength checker?
Aug
23
revised Best password strength checker
added 198 characters in body
Aug
23
comment Best password strength checker
In particular, the Microsoft checker doesn't "follow the math" of the comic wrt to the (limited) entropy added by the l33t-ifying and punct/digit modifiers. It also doesn't use any math for the impact of length on security -- rather it has minimum lengths of 8 and 14 chars.
Aug
23
comment Best password strength checker
The Microsoft checker gives a "strong" rating to both Troubador&3 and Tr0ub4dor&3. Skimming the (javascript) source code, it does seem to be doing the right thing wrt l33t-speak and dictionary words but as a user I can't tell because the rating is so coarse-grained (only 4 grades). For example, password123, p455w0rd123 and 7as4w9rd123 are all "medium", and removing the last character from any of them results in a "weak" password. It doesn't seem to have a very long wordlist, and the rules for "best", "strong" etc. use the same "does it span enough character sets" heuristics other checkers use.
Aug
23
awarded  Student
Aug
23
comment Best password strength checker
Obviously "run JtR on it with a really good ruleset" works as an implementation. Unfortunately if our aim is to be able to say "it would take JtR with a good ruleset >1 yr to find your password" then the checker response time (of up to 1 yr!!) may become an issue. We'd want to have a way to check whether a specific string matched a particular JtR (or equivalent) rule in O(len rule) time rather than O(number of possible matches). Does that exist?