- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Checking Password Complexity with John the Ripper
Password policies designed by well-meaning system administrators dictate the required number of characters and the complexity of passwords, but is that dictated complexity enough to protect user accounts from hackers? We’re told to create passwords that are “easy to remember but hard to guess.” We’re instructed to choose passwords that contain upper- and lowercase letters, that include numbers, and that have a few alternative characters as well. And, we’re discouraged from using the same password for every account. The question is, “Is all that complexity enough to protect us from hackers?” The answer, to further complicate matters, is “Yes” and “No.” |
|
|
Comments (18)
@icafiero --
Not only that, but we make them change often enough that people write them down.
Cool.
Not only that, but we make them change often enough that people write them down.
Cool.
dinotrac,
I understand needing to change your password often if you're always logging in from public places, where someone could see/video you typing it in. And I can see needing to change your password if your account has undergone a large number of failed attempts in a relatively short time.
The stupid rules that many businesses implement, "You must change your password every 30 days AND you cannot reuse the same password within 14 times.." simply drive us to write down our passwords as you suggest. I hate these security "theater" nazis.
I understand needing to change your password often if you're always logging in from public places, where someone could see/video you typing it in. And I can see needing to change your password if your account has undergone a large number of failed attempts in a relatively short time.
The stupid rules that many businesses implement, "You must change your password every 30 days AND you cannot reuse the same password within 14 times.." simply drive us to write down our passwords as you suggest. I hate these security "theater" nazis.
@patrokov -
Yup.
Yup.
I always write down my passwords. Duh. How else can normal people without photographic memories keep track of their logins? Dumbest advice of all time is "Don't write down your passwords." Bruce Schneier says write down your passwords.
http://www.schneier.com/blog/archives/2005/06/write_down_you...
the nice thing about the xkcd suggestion is that you can pick a password like:
if someone sees that piece of paper you can say: oh, that's just some of my favorite quotes.
greetings, eMBee.
Linus Torvalds wrote:My name is Linus Torvalds, and i pronounce Linux as "leenuuks".with punctuation and all, it's not only easy to remember and hard to crack but also save to write down because no one will guess that this is meant to be a password.
if someone sees that piece of paper you can say: oh, that's just some of my favorite quotes.
greetings, eMBee.
patrokov -
At the newspaper for which I work, I have to change my work e-mail password every month. Every month this causes me to ask the IT person to reset my e-mail password because I never remember it. Why? Because I'm not allowed to write it down. They get huffy when I ask them to reset it, and I always respond that if I could write it down, we wouldn't be having these problems. Security theater nazis indeed.
At the newspaper for which I work, I have to change my work e-mail password every month. Every month this causes me to ask the IT person to reset my e-mail password because I never remember it. Why? Because I'm not allowed to write it down. They get huffy when I ask them to reset it, and I always respond that if I could write it down, we wouldn't be having these problems. Security theater nazis indeed.
have you tried alternating between two passwords?
most systems can only compare your new password to the last one previously used because that's what you type in first before you change it. so they can easily be fooled by changing back the previous password on the next change.
of course there are those draconian systems that remember your last 5 or 10 passwords, if you got one of those you are stuck.
does the system compare similarities much? put a number in the password and increment it on each change or even combine the two: password1, alternate2, password3, alternate4...
if that is not enough, try adding month names in an obscure language, the zodiac or even chinese years animals, periodic table or anything else you can look up to remind you.
greetings, eMBee.
of course there are those draconian systems that remember your last 5 or 10 passwords, if you got one of those you are stuck.
does the system compare similarities much? put a number in the password and increment it on each change or even combine the two: password1, alternate2, password3, alternate4...
if that is not enough, try adding month names in an obscure language, the zodiac or even chinese years animals, periodic table or anything else you can look up to remind you.
greetings, eMBee.
I'm going to use CorrectHorseBatteryStaple from now on.
Or....
ourITpoliciesarewrittenbytehterminallymoronic
ourITpoliciesarewrittenbytehterminallymoronic
Damn, another stupid password. This one's for xyz.
Of course, that doesn't work if they require a number, but it could be easily modified.
Of course, that doesn't work if they require a number, but it could be easily modified.
@mbaehrlxer,
Unfortunately, my university's system remember the last 14 passwords you've used. And it won't accept consecutively numbered passwords. Luckily, I've found a few workarounds. You can safely prepend numbers, ie. 11password, 22password, etc. Or you can increment a number in the middle of the password. Of course I hate it when I get locked out of my account BECAUSE I enter my old password three times.
To make things even more ridiculous, they make us change our voicemail passwords every year, and in 8 years, it hasn't ever let me repeat a password. Really. Who's hacking into our voicemail system?
Unfortunately, my university's system remember the last 14 passwords you've used. And it won't accept consecutively numbered passwords. Luckily, I've found a few workarounds. You can safely prepend numbers, ie. 11password, 22password, etc. Or you can increment a number in the middle of the password. Of course I hate it when I get locked out of my account BECAUSE I enter my old password three times.
To make things even more ridiculous, they make us change our voicemail passwords every year, and in 8 years, it hasn't ever let me repeat a password. Really. Who's hacking into our voicemail system?
patrokov wrote:To make things even more ridiculous, they make us change our voicemail passwords every year, and in 8 years, it hasn't ever let me repeat a password. Really. Who's hacking into our voicemail system?
News of the World? Rupert Murdoch? :-)
/me has been waiting for a long time to make this observation. Thanks, patrokov.
And what's Mr. Murdoch doing once he's hacked in? Deleting all our old voicemail that no one knows how to purge? Resetting our greetings to, "All your bases are belong to us. If you are a zerg, please press 1; Space Marines press 2..."
Your guess is as good as mine, patrokov.
> To make things even more ridiculous, they make us change our voicemail passwords every year,
The company I work for is rolling out a system which will require us to change our voice mail password every month. :(
The company I work for is rolling out a system which will require us to change our voice mail password every month. :(
request that voicemails be forwarded to your email with an mp3 attachment, asterisk can do that!
or just stop using voicemail alltogether.
greetings, eMBee.
greetings, eMBee.
> request that voicemails be forwarded to your email with an mp3 attachment,
They'll be doing that too. But as a wav file. Disk space apparently isn't high on their priority list. And not using voice mail isn't an option for my job.
They'll be doing that too. But as a wav file. Disk space apparently isn't high on their priority list. And not using voice mail isn't an option for my job.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
. . . and cut out the John the Ripper middleman.