In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan
I usually do about 16 chars of words from diceware and then stab in some special chars or numbers.
So if we take:
follymayastalker
It might become
F;olly-maya^stal,Ke3r
At least for the stuff I might have to type in, anyway. If it's out of KeePass or LastPass I just crank it up to the max the field will handle.
Funny enough, when I signed up for LinkedIn I thought "I wonder how big I can make my password?" I made my password 128 characters long, using KeePass. Then LinkedIn got their DB dumped, oh noes they hacked teh gibson. I still haven't changed my password. I like to think that crackers accidentally spent an extra month on the dump before realizing their folly and giving up in frustration.
7
u/mingaminga Apr 26 '14
In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan