How a password changed my life
medium.com
medium.com
(Sure, I'm a security guy, and part of me agrees with some of the other comments. Sure, I'm a tech geek, and I've seen and read about some wicked cool hardhacks, unexpected softhacks, and their ilk, and even some good life hacks. But this is awesome. An arguably silly security policy sought to control a small aspect of his work-life and he gamed the spit out of it to take total control of his life, change things up, get stuff done. Best hack ever.)
The way those passwords are constructed don't make them common enough to appear on most word lists and it would be very difficult for someone (who knows you or not) to guess them.
Now, dates of birth, or other common profile information is commonly misused in passwords and that is guessable. But that isn't what the article was about and wasn't in their examples.
I think the article rebuffs your post before you even posted it. So unless you can explain better how what the author is doing is insecure (and I highly doubt you can) your criticism seems misplaced.
Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common).
Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol
Tbh the best password he could have written would probably have been a sentence like
I really should forgive my ex wife who I broke up with on May 23rd @ 8pm!
Is that a job title? I have cracked passwords before, yes.
> Do you have a password cracker database in front of you?
Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks.
> Tbh the best password he could have written would probably have been a sentence like
As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters.
Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).
ѣд学한☏
Seems pretty secure, but it's not over 8 characters...
If UTF8 was better supported, you could do something like
phone, snowman, snowman, pile of poo, phone.
That's fairly easy to remember and next to impossible to guess.
For offline attacks, if the password is stored using something relatively insecure like SHA256 (which is not compromised, it's just too fast), it's very inexpensive to make billions of guesses per second against a hash like that. They'll go through a list of the top 10 million most common passwords, then start iterating through lists of combinations of common dictionary words. Most password cracking software is very smart and will try all kinds of substitutions.
Assume that "Forgive" and "her" are in a dictionary of the 2000 most common words. Trying all 2-word combinations would be 2000^2 = 4 million guesses. They try with and without a special character (including a space) between them - assuming say 15 different characters, that's 60 million guesses. Try it with the first letter capitalized and uncapitalized, then also try each word alternately in all-caps (multiply by 5) 300 million guesses. Let's assume that each word, using common "1337" substitutions, has an average of 10 alternate forms - that's 3 billion guesses to cover the entire space of the 2000 most common words with all kinds of variations. On average your password will be about halfway through the list, so say 1.5 billion guesses to get there. If you used a $50 GPU, this would take maybe 10-20 seconds to complete. If you used ASICs designed for mining bitcoin, it would take much, much less than a second.
Of course, the attackers might try other strategies. If they used a pure brute force, they'd never get to Forgive@her, but password cracking has gotten a lot smarter than that. You're basically taking a risk that this strategy (which is actually a subset of a more commonly used strategy) is not known by the hackers, because if it is, you'll be cracked very, very quickly.
Best practice in password strategies is to assume that the hacker knows your exact strategy and calculate the entropy of the password. The best "bang for your buck" is fully random, random-case passwords with all special characters possible. Assuming a 96 character set, a 12-character password like that has about 10^23 combinations, so even making 100 trillion guesses per second would take 200 years. If you want to use words, effectively case insensitive, you'll probably need more characters (but fewer words) - a password of equivalent security drawn from a pool of 10,000 words would be 6 words long. You can obviously use a mix of strategies to get the balance you'd prefer.
On top of it, people get compromised all the time. Its trivial for a virus to nab your saved browser passwords. Or someone sends you a phishing link and you happily type in your credentials. It looked official, right?
All of this is invisible to the end user, typically. From the IT side of things these credentials are used for all sorts of things like authenticating with smtp to use our mail server to send spam, log into ftp sites to host malware, etc, etc. Then the end user angrily walks up to IT saying, "Everyone is saying my emails are spam. Why do you guys suck so much??!!"
Forcing password rotation helps with this because there's a chance the password that got leaked is or will soon be retired. It also helps in scenarios when employees give their passwords out to other employees and then one of them gets fired and starts fucking with the system using someone else's credentials.
In short, a lot of these polities exist because people are stupid. Don't blame those of us trying to mitigate the damage. That said, you don't need a 30 day expiration. I find 120-180 days works well enough. You don't need complexity turned on as much as you need a sane minimum length. I'd rather train people to use "mydogsnameisAlbert" than "Password1"
In other words, they will resort to using less-secure passwords. The notion that rotating passwords improves security is little more than a cargo-cult.
I think it's obvious that expiring passwords increases security to some degree. It's also clear that user reactions will induce people to reduce the security of those passwords. The password expiry interval you choose (potentially as long as the duration of the system's existence) depends on your threat model, really. Security is hard and often application-specific.
Thus, I find myself writing new poems all the time. Which is actually great because they are fun to make and easy to remember. But yeah if I still used that one (something I wrote in 2008) I'd be screwed. There's no way that's safe now.
What really drives me insane are services that limit the number of characters you can have for your password. Holy criminy that's dumb.
However if someone steals a whole password database with a million passwords, chances are they just automate the login attempts and subsequent nefarious actions. They might not try to figure out anyone's naive password scheme if they get thousands of successful logins the easy way!?
I'm saying this because I've heard your reasoning before, and of course I've been staring at the keyboard when trying to change one of my passwords, wondering just how clever I need to be right there.
8 characters or longer
lowercase
uppercase
number
random symbol
As far as I am concerned if I want to make my password jumping I should be able too, forcing someone to make a password they will never remember leads to several issues.
1. A password cracker knows exactly what to ignore which such requirements (obviously his 4 letter word dictionary is useless in this case).
2. People have trouble remembering them, so they typically write them down somewhere (a even bigger issue).
3. It's security through obscurity.
https://en.wikipedia.org/wiki/Affirmative_prayer#Self-help
http://www.self-help-and-self-development.com/affirmations.h...
My password is some variation of how much of an asshole he is. But it's not helping. In fact, it's causing me to constantly dwell on it, painfully re-living our conversations, and thinking what I could've done differently to prevent it from happening.
Logically I understand that I need to forgive him and let it go, but I'm not able to do it. I'm going to change my password to an affirmation that I forgive him. I think it will be a good start.
It might be more useful to use a long sentence passphrase for Windows/Exchange purposes.
There are versions of that site which do everything in Javascript so your password is never sent to the server. That is also insecure but at least they pretend that it is not.
This site is designed to post your password up to the server and even works on HTTP (as opposed to enforcing HTTPS only). So you've just shared your password, IP address, and browser information with a completely anonymous site!
PS - I think this site is DESIGNED to be Javascript only but the implementation is bad, so the password is in fact sent to their server (which generates an "Internal server error" by the way).
You can download it here: https://github.com/c-a-m/passfault
And the project itself is affiliated with OWASP.
So I'm confused why after a few days you would still remember what the password means when you type it in.
Looking back, I could have improved myself. Kudos for the inspiration!