0

Safari on recent versions of Mac OSX can suggest passwords on signup forms. These passwords have the a similar form (the alphanumeric characters are separated by dashes: AbC-dEf-941-T3k) and they only contain 12 alphanumeric characters.

How safe are these passwords?

  • Is AbC-dEf-941-T3k the actual password recommended or just an example of the mask it uses? – Mr. E Oct 17 '16 at 19:07
  • it's the latter – gen Oct 17 '16 at 20:40
1

I believe that answering this question based on the mere complexity of the password generated may miss the mark. While it appears the passwords generated by Safari/OSX Keychain are quite complex and would be virtually impossible to crack with technology available today, this only helps in defeating brute force attacks.

Much more commonly, passwords are discovered through:

  • Malware/Keyloggers
    • This OSX keychain access should make it harder for malware and certainly keyloggers (since you're not typing anything) to obtain passwords.
  • Password re-use
    • Reuse of same password on multiple sites means taht if one site is compromised/experiences a breach, hackers will try this username/password combination on other sites.

So, that said, using unique passwords for each site and a password manager like Safari/Keychain increases your security significantly. This security enhancement goes far beyond the simple complexity of passwords, because by using a password manager you're engaging in a best practice that helps defeat numerous types of attacks to get your password.

1

Worst case scenario, assuming the attacker knows you are using this form, that is 62^12. Assuming they can try 100,000,000 passwords a second (which they almost certainly can't), it would still take them a million years.

So.. pretty good.

  • Is this truly a "worst case scenario"? If the PRNG or random number generation process was flawed, these odds get a lot shorter. – Herringbone Cat Oct 17 '16 at 19:09
  • 1
    I suppose - that is worst case assuming that Apple is reasonably competent and uses the crypto random number generator they already have. – crovers Oct 17 '16 at 19:21
  • 1
    If they've got a database dump and the website is foolishly using MD5 hashing, they can potentially try more like a hundred billion per second than a hundred million, bringing the cracking time down to only a thousand years. – Mike Scott Oct 17 '16 at 19:25
  • @MikeScott All that being true, still WAY better than most user generated passwords. – crovers Oct 17 '16 at 19:30
  • @HerringboneCat randomness is precisely what I'm concerned about; crovers: I can derive 62^12 on my own, my question is not about that.. – gen Oct 17 '16 at 20:42

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.