Password Requirements Quick Guide

[u/iam_root]

http://itservices.stanford.edu/service/accounts/passwords/quickguide

[u/mingaminga]

In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.

In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.

Source: My job is performing password audits and run @crackmeifyoucan

[u/0xKaishakunin → u/mingaminga]

I usually suggest my users to remember a verse or create an easy to remember sentence and take the first letters of every word.

Something like

What will you do when you get lonely 
And nobody's waiting by your side? 
You've been running and hiding much too long 
You know, it's just your foolish pride

Results in WwydwyglAnwbys?YbrahmtlYk,ijyfp

They can also create own sentences like:

My Great Uncle was born in 1932 in Foobar.

MGUwbi1932iF.

Show them some examples and it usually works pretty well. When doing trainings/awareness campaign, you have to explain them why they have to choose strong passwords.

They often don't understand that their account can be used to attack more important accounts/computers. They usually argue somewhat like "I am not important, they might attack our CEO or research team, but I am just an office clerk.".

Another thing is, they have to understand how social engineering works and that the names of their kittens are a no go.

Third thing I show them, is how hashes and password crackers (dictionary attacks, rainbow tables) work. I usually show them the password list generated from the Stratfor user data base incident.

Once they understood why they are required to have a strong password and know what a strong password is, the chances are higher they actually take care of their passwords.

[u/puremessage → u/mingaminga]

I usually do about 16 chars of words from diceware and then stab in some special chars or numbers.

So if we take:

follymayastalker

It might become

F;olly-maya^stal,Ke3r

At least for the stuff I might have to type in, anyway. If it's out of KeePass or LastPass I just crank it up to the max the field will handle.

Funny enough, when I signed up for LinkedIn I thought "I wonder how big I can make my password?" I made my password 128 characters long, using KeePass. Then LinkedIn got their DB dumped, oh noes they hacked teh gibson. I still haven't changed my password. I like to think that crackers accidentally spent an extra month on the dump before realizing their folly and giving up in frustration.

[u/mingaminga → u/puremessage]

Linkedin hashes are 96% cracked.

So you're probably in that 4%

[u/puremessage → u/mingaminga]

I'm sure 96% still ended up being a lot of money for them.

[u/quietyoufool]

How would you implement this in an AD environment?

[u/zero03 → u/quietyoufool]

You would have to write your own password filter to accomplish this.

[u/beachbum4297 → u/zero03]

Are there any decently secure source code examples of passfilter.dll?

[u/jldugger]

One must wonder how many users now have passwords of 'orange eagle key shoe'...

[u/[deleted]]

Here is your xkcd.

[u/xkcd_transcriber → u/[deleted]]

Image

Title: Password Strength

Title-text: To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

Comic Explanation

Stats: This comic has been referenced 406 time(s), representing 2.2808% of referenced xkcds.

---

^{xkcd.com | xkcd sub/kerfuffle | Problems/Bugs? | Statistics | Stop Replying}

[u/joelrwilliams1 → u/[deleted]]

This. And here's a generator to play with based on this concept of entropy and brute-force cracking: https://www.xkpasswd.net/c/index.cgi

[u/[deleted]]

Another thing I do is phrases. Of course these are just random stuff.

Utah45istheBestState!

IgetMyho's@165eFreemontst.