Slashdot Mirror
Calculating Password Policy Strength Vs. Cracking
snydeq writes "InfoWorld's Roger Grimes offers a spreadsheet-based calculator in which you can key in your current password policy and see how your organization's passwords might hold up against the number of guesses an attacker can make in a given minute. The calculator includes results for four different password entropy models, and is based on length, character set, maximum age, whether complexity is enabled, and the number of guesses per minute an attacker can attempt. As an example, Grimes assumes an eight-character password, with complexity enabled, a 94-symbol character set, and 90 days between password changes. Such a policy, typical for many organizations, would require attackers to make only 65 guesses per minute to break — not at all hard to accomplish, Grimes writes."
Some systems will intentionally "lag" you on a failed password attempt, or wait some time before the next guess. So you can't even MAKE 64 guesses a minute.
Others will lock you out after 3-5 attempts.
Kind of stops this flat, hmm?
on average, you would find the answer in half the time. also that is just a brute force attack, you have to consider dictionary attacks and other sneaky tricks
Which is still solved by a quick look at the logs. Any account with multiple login attempts from multiple IP addresses in rapid succession should be a huge red flag. Even without human review it's trivial to make the block on the account, not on the party that's trying to log in.
The real problem is striking a balance between complexity and usability. You don't need a botnet if you can grab the passwords using any number of social engineering techniques, many of which are made much easier when people are pushed into habits like writing their login details on post-it notes.
First off, there should NOT be any indication whether the username was valid or not. It's as simple as that.
Secondly, the issue really comes down to whether a DoS attack is better/worse than a compromised account.
I'm on the side that believes compromised accounts are WAY worse than a DoS attack.
i.e. Hackers whose goal in life is to disrupt access to the system rather than to break in.
Those type of hackers are rare and have less resources. There isn't any point in pure vandalism you see. In any case research has shown that it's not a primary motive.
http://www.aic.gov.au/publications/htcb/htcb006.html
Show a man some news, distract him for an hour. Show a man some mod points, distract him for the rest of his life.
It's not an irrelevant factor. Without any password changes, you are guaranteed to get the password eventually. If you do change passwords, you are trying to hit a moving target. You might get it, you might not, and even if you do, you don't have long before you have to run the attack again.
that implies that the password hacker has a mean to ascertain if a password he tried was a "near miss", i.e."congratulations! you got X characters right but on the wrong place, and Y characters right and in the right place. Try again? Y/N". BTW, Mastermind anyone?
Here in italy the security model approved by the law is : 8 char password, change every 90 days. I agree that changing passwords, or even forcing user to use password that are totally different from those previously used, is futile if you do not allow user to pick passphrases instead of password; they'll stick a post-it to the screen.
Fixed lenght is a big help to password crackers. Most software vendors tough use it as such, meaning that a password must be * exactly 8 characters *. Given that, I'll give you my recipe for password generation:
1. look around you, and find something that has a 6 character name;
2. Add the suffix "01" at the end, chenging it to "02" when 90 days have elapsed;
3. ????????
4. Profit!!
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
Divide that in half again. You can break an 8 character password in to two 4 character passwords and crack them in parallel
This is simply not true. In parallel, you can do two attempts at once, but dividing it into two 4-character passwords is definitely not possible. If it were, you could divide each of those into two 2-character passwords, each of those into two 1-character passwords. You'd then have eight 1-character passwords to crack and have to do 8 * 256 = 2048 attempts to crack any 8-character password (assuming each character could be any ASCII character, fewer if it's a restricted subset). This is only the case in very-flawed systems where each character can be tested individually. There was an OpenSSL vulnerability a while ago that made this true - the return time could be used to infer which byte of the key was the first incorrect one - but it isn't the case on any common system.
Divide that in half again. You can break an 8 character password in to two 4 character passwords and crack them in parallel
Ex falso quodlibet.
I am TheRaven on Soylent News
Quotith the freakin' wikipedia page:
Although it is based on DES, a well-studied block cipher, the LM hash can easily be cracked due to two weaknesses in its implementation. First, passwords longer than 7 characters are divided into two pieces and each piece is hashed separately. Second, all lower case letters in the password are changed to upper case before the password is hashed. The first weakness allows each half of the password to be attacked separately. While there are 95^{14} \approx 2^{92} different passwords made of up to 14 printable ASCII characters, there would be only 95^{7} \approx 2^{46} different 7 character password pieces using the same character set. Restricting the character set by converting lowercase to uppercase further reduces the number of possibilities for each half to 69^{7} \approx 2^{43}. By mounting a brute force attack on each half separately, modern desktop machines can crack alphanumeric LM hashes in a few hours.
LM hash does not include salt, therefore a time-memory trade-off cryptanalysis attack, such as rainbow tables, is also feasible. In 2003, Ophcrack, an implementation of the rainbow table technique, was published. It specifically targets the weaknesses of LM encryption, and includes pre-computed data sufficient to crack virtually all alphanumeric LM hashes in a few seconds. Many cracking tools, e.g. RainbowCrack, L0phtCrack and Cain, now incorporate similar attacks and make cracking of LM hashes trivial. However, because LM hashing is not used for passwords of 15 characters or longer, these are relatively strong.
Well done geezer, I'll get you next time though! :)
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.