network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year, 9 months |
| seen | May 20 '12 at 21:36 | |
| stats | profile views | 55 |
|
Aug 25 |
awarded | Teacher |
|
Aug 25 |
answered | How to best set up public WiFi without giving access to the rest of my network? |
|
Aug 24 |
comment |
Best password strength checker How secure...: plain & initial-cap = instant ("in top 6910"), i->1, s->5 = 1 year, +& = 928 years, +&3 = 71K years. How secure... also uses a wordlist but doesn't use it to reduce its entropy estimate as such, and l33t-speak defeats it. It doesn't use diagraph-frequences so words score the same as alpha-gibberish the same length. |
|
Aug 24 |
comment |
Best password strength checker Rumkin.com: plain = 29.9b ("common password!"), initial-cap = 36.3b ("common password!"), i->1 = 38.7b, s->5 = 38.1b, +& = 43.1b, +&3 = 46.7b. Rumkin uses a wordlist to detect "common passwords", BUT it doesn't reduce the entropy as a result. It does use character digraphs to estimate the entropy (based on English digraph frequencies), which will compensate for that to some extent. However, it doesn't take l33t-speak substitutions into account for either the "common word" or digraph frequency estimates. |
|
Aug 24 |
comment |
Best password strength checker As a simple test, lets try some variations of "christmas" (plain lower case, initial cap, i->1). |
|
Aug 23 |
revised |
How reliable is a password strength checker? corrected and elaborated entropy calculation for password and passphrase |
|
Aug 23 |
revised |
How reliable is a password strength checker? caveat on article reference |
|
Aug 23 |
suggested | suggested edit on How reliable is a password strength checker? |
|
Aug 23 |
suggested | suggested edit on How reliable is a password strength checker? |
|
Aug 23 |
revised |
Best password strength checker added 198 characters in body |
|
Aug 23 |
comment |
Best password strength checker In particular, the Microsoft checker doesn't "follow the math" of the comic wrt to the (limited) entropy added by the l33t-ifying and punct/digit modifiers. It also doesn't use any math for the impact of length on security -- rather it has minimum lengths of 8 and 14 chars. |
|
Aug 23 |
comment |
Best password strength checker The Microsoft checker gives a "strong" rating to both Troubador&3 and Tr0ub4dor&3. Skimming the (javascript) source code, it does seem to be doing the right thing wrt l33t-speak and dictionary words but as a user I can't tell because the rating is so coarse-grained (only 4 grades). For example, password123, p455w0rd123 and 7as4w9rd123 are all "medium", and removing the last character from any of them results in a "weak" password. It doesn't seem to have a very long wordlist, and the rules for "best", "strong" etc. use the same "does it span enough character sets" heuristics other checkers use. |
|
Aug 23 |
awarded | Student |
|
Aug 23 |
comment |
Best password strength checker Obviously "run JtR on it with a really good ruleset" works as an implementation. Unfortunately if our aim is to be able to say "it would take JtR with a good ruleset >1 yr to find your password" then the checker response time (of up to 1 yr!!) may become an issue. We'd want to have a way to check whether a specific string matched a particular JtR (or equivalent) rule in O(len rule) time rather than O(number of possible matches). Does that exist? |
|
Aug 23 |
comment |
Best password strength checker I can imagine that a JtR ruleset would be ordered to try the rules that result in the smallest search-space first (commonly-used passwords, then common-password-words-with-minor-digit-variations, then l33t-sp34k, then markov-chain di/trichar patterns, etc.). The ruleset would include as many as possible of the "how to complexify your password" and methods found on the web. Possibly the order could be adjusted to take account of likelihood (e.g. based on how frequently they are found in password leaks such as gawker). |
|
Aug 23 |
comment |
Best password strength checker Well, ideally the rating would closely correspond with the amount of time that an actual attacker (using "state of the art" techniques, not just character-by-character brute-forcing) would take to find the password. Those techniques would include l33t-sp34k transformations, common passwords, wordlists, etc. |
|
Aug 23 |
revised |
Best password strength checker added 531 characters in body |
|
Aug 23 |
asked | Best password strength checker |
|
Aug 23 |
awarded | Editor |
|
Aug 23 |
revised |
XKCD #936: Short complex password, or long dictionary passphrase? Expanded key messages |
