Timeline for How different should my passwords be?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 9, 2015 at 15:15 | history | edited | David Mulder | CC BY-SA 3.0 |
added 2 characters in body
|
| Oct 9, 2015 at 14:54 | history | edited | David Mulder | CC BY-SA 3.0 |
added 404 characters in body
|
| Nov 6, 2014 at 21:22 | comment | added | Matthew Peters | @Xander, which is why we should always assume our algorithm of creating passwords is known. | |
| Nov 6, 2014 at 20:45 | comment | added | David Mulder | @Xander: And it's not irrelevant because the sentence before that was there to get to the actual point what entropy defines... | |
| Nov 6, 2014 at 20:44 | comment | added | David Mulder | @Xander: And wow, applying principles in the wrong place is quite the nice act as well... Yes, that's definitely true for cryptography about which he was writing. It has nothing to do with passwords though, yes, knowing the process compromises the system, however the process in this case is the key. And yes, knowing the key will undo a cryptographic system as well. | |
| Nov 6, 2014 at 20:42 | comment | added | David Mulder | @Gilles: Nah, sites start with adding a timeout, then a longer timeout, and then they block either the IP or the user. | |
| Nov 6, 2014 at 20:42 | comment | added | Xander | "How nice of you to be so selective in your quotes and leave out the next sentence" I left out the next sentence because it is irrelevant. | |
| Nov 6, 2014 at 20:39 | comment | added | Xander | This is a weak system because it violates Kerckhoffs's principle which says when the algorithm is known, the system should remain strong. This is not the case here, because the algorithm is extremely insecure. It combines a bunch of static data with a tiny amount of deterministic data. Whereas a random password must be brute forced even if the algorithm is known, if your suggested algorithm is known, it would take an average of approximately 1 attempt to guess any password generated this way. This is pure security through obscurity. | |
| Nov 6, 2014 at 20:39 | comment | added | Gilles 'SO- stop being evil' | The shared string may have high entropy, but if it is known, then all the passwords are known, or very very close (with negligible entropy). Thus the “Site hack” section is wrong. 10 attempts is very little. If a site locks out an account after 10 failed attempts, it'll be extremely vulnerable to denial of service. | |
| Nov 6, 2014 at 20:35 | comment | added | David Mulder | @Xander: How nice of you to be so selective in your quotes and leave out the next sentence "Put another way, a password with 42 bits of strength would require 242 attempts to exhaust all possibilities during a brute force search." And the thing to understand here is that these characters have been chosen randomly, only in the context of this password scheme as a whole can they be considered non random. And the idea of considering entropy an attribute of the process rather than the result is flawed because it is the result that's being attacked, not the finished process. | |
| Nov 6, 2014 at 20:33 | comment | added | Xander | The Wikipedia article you link to actually says essentially exactly the same thing as Pornin. "A password with, say, 42 bits of strength calculated in this way would be as strong as a string of 42 bits chosen randomly, say by a fair coin toss." You do not have random bits. You have a bunch of static bits, and 8 bits (the single character that changes) that is chosen in a deterministic fashion, so not even that is random. | |
| Nov 6, 2014 at 20:27 | comment | added | David Mulder | And @everybody, if you guys disagree, than attack this answer on the grounds of the actual concepts it's proposing. I know it goes against what is commonly taught in school, but if it truly is so ineffectual than explain me how this can be so easily attacked. | |
| Nov 6, 2014 at 20:25 | comment | added | David Mulder | of the amount of randomness in the password. Now, in this area it becomes more complex and Pornin is suggesting a solution where one looks at the process rather than the password, but that proposal is flawed exactly because of examples such as presented in this answer. | |
| Nov 6, 2014 at 20:24 | comment | added | David Mulder | @Xander: Although he's trying to redefine the meaning of entropy in password world, the definitions say otherwise: en.wikipedia.org/wiki/… (that was simply the first search result). Now his point is correct that the entropy added by a word is not equal to the sum of all the entropies of each individual character, because in the world they have certain tendencies to be together (as outlined in the wikipedia article as well), however entropy is a measure of password strength, which is a direct representation | |
| Nov 6, 2014 at 20:13 | comment | added | Xander | Calculating complex password entropy? | |
| Nov 6, 2014 at 19:54 | comment | added | David Mulder | @Xander: Absolutely wrong, information entropy says something about the amount of 'information' a 'message' contains. Yes, knowing all variations one could argue that as a whole the entropy is lower than on it's own, but even so, on it's own is what we're talking about. It has nothing nothing to do with the 'password generation process'. | |
| Nov 6, 2014 at 19:48 | comment | added | Xander | Entropy is a property of a password generation process, not of a password. This password generation process you're proposing has not high entropy as you claim, but in fact almost no entropy at all. | |
| Nov 6, 2014 at 19:38 | history | answered | David Mulder | CC BY-SA 3.0 |