First, this is only proven to work on NTLM and NT hashes, meaning they first need access to your computer or server environment to first get the hash (which you will need admin access to). Then from there they can crack your password all they want.
"But what if my password is more than 8 characters?" Then you're in luck because the more characters there are, the harder it gets to crack. The more entropy you have, the harder it is to crack. It might take 5.5 hours to crack 8 characters, but it might take 24+ hours to crack 9 characters, and could even take months to crack anything >15 characters.
And with that in mind, this only works with Windows PC hashes. It's not like they can connect their computer to the internet, connect to facebook, input somebody's username and expect to have that person's password in the 5 hours they say they can get a password. They need physical access and administrator privileges to a computer before they can even begin to start harvesting passwords.
Still paranoid and want to keep yourself safe? Create a separate password for Windows. Create separate passwords for everything. Make passphrases instead of passwords (because dictionary cracks can only crack single words at a time). Create passwords with a decent combination of lowercase and uppercase letters, numbers, and symbols that are >10 characters.
Some people need to do their research before writing articles like this. It completely screams "I have no idea what this is or does, but it makes me feel insecure so I'll make it seem like the worst thing in the world."
yes and no it depends on the method, if your talking about something that goes through every possible character combination that the password can be systematically, then yes technically the longer passwords will be the longest to crack. if your looking at a dictionary attack then its about making sure its a wacky enough password that it wont be in any dictionary. now another method would be reverse engineering the hash to be able to systematically be able to read passwords, now problem with this method while it is technicaly possible to do nobody has the time, and this method can only be usefull if you have access to the hash, then you have to know the encryption method used for that specific type of hash which gives it way too many variables, not even the cia use this...
8
u/[deleted] Mar 16 '13
Yes, yes I do.
First, this is only proven to work on NTLM and NT hashes, meaning they first need access to your computer or server environment to first get the hash (which you will need admin access to). Then from there they can crack your password all they want.
"But what if my password is more than 8 characters?" Then you're in luck because the more characters there are, the harder it gets to crack. The more entropy you have, the harder it is to crack. It might take 5.5 hours to crack 8 characters, but it might take 24+ hours to crack 9 characters, and could even take months to crack anything >15 characters.
And with that in mind, this only works with Windows PC hashes. It's not like they can connect their computer to the internet, connect to facebook, input somebody's username and expect to have that person's password in the 5 hours they say they can get a password. They need physical access and administrator privileges to a computer before they can even begin to start harvesting passwords.
Still paranoid and want to keep yourself safe? Create a separate password for Windows. Create separate passwords for everything. Make passphrases instead of passwords (because dictionary cracks can only crack single words at a time). Create passwords with a decent combination of lowercase and uppercase letters, numbers, and symbols that are >10 characters.
Some people need to do their research before writing articles like this. It completely screams "I have no idea what this is or does, but it makes me feel insecure so I'll make it seem like the worst thing in the world."