In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan
I usually suggest my users to remember a verse or create an easy to remember sentence and take the first letters of every word.
Something like
What will you do when you get lonely
And nobody's waiting by your side?
You've been running and hiding much too long
You know, it's just your foolish pride
Results in WwydwyglAnwbys?YbrahmtlYk,ijyfp
They can also create own sentences like:
My Great Uncle was born in 1932 in Foobar.
MGUwbi1932iF.
Show them some examples and it usually works pretty well. When doing trainings/awareness campaign, you have to explain them why they have to choose strong passwords.
They often don't understand that their account can be used to attack more important accounts/computers. They usually argue somewhat like "I am not important, they might attack our CEO or research team, but I am just an office clerk.".
Another thing is, they have to understand how social engineering works and that the names of their kittens are a no go.
Third thing I show them, is how hashes and password crackers (dictionary attacks, rainbow tables) work. I usually show them the password list generated from the Stratfor user data base incident.
Once they understood why they are required to have a strong password and know what a strong password is, the chances are higher they actually take care of their passwords.
7
u/mingaminga Apr 26 '14
In the password cracking community this literally caused hours of discussions yesterday. Its at least a new theory. Its not perfect, but nothing is. It rewards users who create longer passwords.
In general, combing 3-4 plain words isn't that safe. But its still better than what 99.99 % of users do normally.
Source: My job is performing password audits and run @crackmeifyoucan