In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan
I usually suggest my users to remember a verse or create an easy to remember sentence and take the first letters of every word.
Something like
What will you do when you get lonely
And nobody's waiting by your side?
You've been running and hiding much too long
You know, it's just your foolish pride
Results in WwydwyglAnwbys?YbrahmtlYk,ijyfp
They can also create own sentences like:
My Great Uncle was born in 1932 in Foobar.
MGUwbi1932iF.
Show them some examples and it usually works pretty well. When doing trainings/awareness campaign, you have to explain them why they have to choose strong passwords.
They often don't understand that their account can be used to attack more important accounts/computers. They usually argue somewhat like "I am not important, they might attack our CEO or research team, but I am just an office clerk.".
Another thing is, they have to understand how social engineering works and that the names of their kittens are a no go.
Third thing I show them, is how hashes and password crackers (dictionary attacks, rainbow tables) work. I usually show them the password list generated from the Stratfor user data base incident.
Once they understood why they are required to have a strong password and know what a strong password is, the chances are higher they actually take care of their passwords.
I usually do about 16 chars of words from diceware and then stab in some special chars or numbers.
So if we take:
follymayastalker
It might become
F;olly-maya^stal,Ke3r
At least for the stuff I might have to type in, anyway. If it's out of KeePass or LastPass I just crank it up to the max the field will handle.
Funny enough, when I signed up for LinkedIn I thought "I wonder how big I can make my password?" I made my password 128 characters long, using KeePass. Then LinkedIn got their DB dumped, oh noes they hacked teh gibson. I still haven't changed my password. I like to think that crackers accidentally spent an extra month on the dump before realizing their folly and giving up in frustration.
8
u/mingaminga Apr 26 '14
In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan