Skip to main content
13 events
when toggle format what by license comment
Mar 17, 2017 at 13:14 history edited CommunityBot
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Jan 26, 2016 at 17:34 comment added PwdRsch As for your question about failure of decent passwords, there are a few examples that I can think of, but here's a pretty good one regarding bitcoin brainwallet cracking by Ryan Castellucci. If you look at page 33 of the slide PDF he lists a few examples of the passphrases he cracked, which I'd argue many people would believe most of them were secure, and yet there weren't strong enough in this case.
Jan 26, 2016 at 17:29 comment added PwdRsch Hey @fgysin this paper may not answer the part of your question about a weakly created password actually being exploited but it does provide insight on what password strengthening measures average people take that may not provide much security benefit.
Jan 26, 2016 at 15:44 comment added Matthew The problem is that very few breaches are dependent on a single factor, such as password policies being weak. Weak password policies won't cause database extraction. They won't help with poor password storage. However, the breaches you see which include passwords usually have both of these. There are other breaches, but if you can't crack the passwords, you can't assess the password strength.
Jan 26, 2016 at 15:38 history closed GdD
Ohnana
Xander
Stephane
Matthew
Opinion-based
Jan 26, 2016 at 15:18 comment added fgysin Why the votes for close? Can someone suggest edit that would make this question more eligible? (I'm really asking for specific real world occurrences of failure of decent password policies - this seems answerable to me, if not necessarily obvious.)
Jan 26, 2016 at 15:18 comment added Trey Blalock I think another way to answer your question is to look at what has been found in public password dumps, specifically cases where the passwords were hashed and a large percentage were cracked. For example we do sometimes see different password techniques showing up in those large sets of "cracked passwords" which would imply that the users did attempt to do something beyond the basic level of passwords. I think the fact that these too occasionally get cracked means that teaching better password development techniques is in fact still relevant.
Jan 26, 2016 at 14:12 comment added Steve Dodier-Lazaro Agreing with @GdD here. I have unpublished research which explains why current password research might be a problem but I'm not willing to share that pre-peer-review. I can go on and on about why there might be issues, but if you want a somewhat objective account of the limitations of password policies on actual security... come back in 10-15 years, even the best researchers in our field aren't able to do that yet. Partly because we don't have good enough methods for measuring security outcomes in organisational contexts, at least yet.
Jan 26, 2016 at 14:01 review Close votes
Jan 26, 2016 at 15:38
Jan 26, 2016 at 13:39 comment added GdD I would love to answer this question, however it would be too based on opinion rather than fact.
Jan 26, 2016 at 13:38 comment added fgysin This is what I meant, really. Is it actually worth our time to still be discussing password policies when an exploit/backdoor/phishing/social engineering/... attack is so much more likely...
Jan 26, 2016 at 13:02 comment added Steve Dodier-Lazaro "I think we can all agree on the qualities good passwords need." not even close :D I personally think most research on the topic is deeply, deeply bogus. The strength of an individual password from an individual user means absolutely nothing in 2016.
Jan 26, 2016 at 12:47 history asked fgysin CC BY-SA 3.0