Village Elder - Comments

John Curry: Great comments from Computer Defence

john@village-elder.com (John Curry) — Tue, 13 Mar 2007 08:50:34 -0500

Great Stats Igor! Thanks for sharing!

Igor Drokov: Great comments from Computer Defence

john@village-elder.com (Igor Drokov) — Tue, 13 Mar 2007 08:37:28 -0500

Talking about passprase-based passwords, there is a report published in 2000 on "The memorability and security of
passwords some empirical results" based on the study of 400 first-year students at the University of Cambridge. The report provides some interesting data, e.g.:

"The summary of the number of cracked passwords is as follows (with brute-force attacks treated separately):

- Control group 30 (32%) +3 brute force
- Random password group 8 (8%) +3 brute force
- Passphrase group 6 (6%) +3 brute force
- Comparison sample 33 (33%) +2 brute force"

Full report: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-500.pdf

John Curry - on behalf of Jordan: A realistic approach to creating very strong passwords

john@village-elder.com (John Curry - on behalf of Jordan) — Thu, 01 Mar 2007 17:50:18 -0600

The comment below was valiantly attempted to be posted here only to fail because I haven't worked out all my blogging mojo yet. Jordan sent this in with another great link on password policy. Thanks Jordan, I think I have this sorted now -john
---
That's a great writeup. We recommend something similar, though without
quite as much detail on our password page at the University of Florida:

http://infosec.ufl.edu/athome/passwords.shtml

Thanks for the explanation.

Keri: To sudo or not to sudo

john@village-elder.com (Keri) — Thu, 01 Mar 2007 07:28:23 -0600

You know your sudo command always worked on me =) Miss you tons! hugs

Ricky: To sudo or not to sudo

john@village-elder.com (Ricky) — Wed, 28 Feb 2007 10:19:07 -0600

I think, when properly applied, the sudo command can have a dramatic effect on lunch.

John Curry: A realistic approach to creating very strong passwords

john@village-elder.com (John Curry) — Wed, 28 Feb 2007 08:45:33 -0600

Thats a good point Wilbur! Perhaps it's too much to say this method will create 'very strong' passwords. I know that I have seen some pretty ugly passwords in the field. Often terrible things like:

baseb@ll
r1234
mypass

Eeeks, keeps me up at night! I think compared to passwords of that level the technique I propose would fair pretty well.

I certainly wouldn't suggest any of the standard 3l173or 'elite' character replacements, they are just to common now, and I always feel dirty when I think about using them.

If anyone can use this technique to beef up their passwords a few notches in the right direction, then I think my work is done.

Perhaps I'll do a follow up post on how to create 64 character passwords for the non mensa member

That gives me another idea. password olympics! I think I'll see about setting up some cracking tools to test who's 8 character password hold out the longest. hrm.. let me look into that!

Wilbur: A realistic approach to creating very strong passwords

john@village-elder.com (Wilbur) — Wed, 28 Feb 2007 07:22:50 -0600

Have you performed any analysis of the passwords, perhaps with common phrases? It's easy to suggest that they are strong but I think that there are a lot of letters that are not as commonly the first letter of a word in a phrase. Some simple analysis could show the distribution.

There are already password attackers that factor all the "elite" speak letters and numbers in, they don't increase the distribution nearly as much as you might think.

Brian: A realistic approach to creating very strong passwords

john@village-elder.com (Brian) — Wed, 21 Feb 2007 09:16:14 -0600

Check out "rainbow table attacks", which have effectively made your 8-character password obsolete (save for in systems that salt their hashes, such as Unixes). Now I take the type of passwords you talk about, and string two together separated with punctuation. Thus, I would use
What the f is your problem
(W7f1urPr0b)
with
This ain't my momma's cookin'
(T8ntMm'scKn)
and turn it into
W7f1urPr0b#T8ntMm'scKn

(hypothetically...)