Re: Password complexity - improvement

On 2007-08-16 Thor (Hammer of God) wrote:
Ah.... NOW I see what you mean... As in, if you required all 4
complexity requirements, and you knew the first three characters were
Aa1, then you'd know for a fact that the last character had to be a
"special" character...

Not exactly. By requiring characters from all 4 groups to be present in
the password you reduce the number of passwords attacker must brute-
force (because he can skip certain passwords now). How much that will
gain him effectively depends on the length of the passwords and the
number of special characters. I agree that for passwords of reasonable
length and with an adequate number of special characters the loss will
indeed be negligible, but I still think you need to take this effect
into consideration before implementing a policy like that.

Only problem with that is that a BF attack does not give us one
character at a time. You have to "crack" the hash in singularity...

I am aware of that.

Regards
Ansgar Wiechers
--
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html

Relevant Pages

  • Re: US Military bans HTML in emails
    ... Complex passwords are not that much harder to ... Consider a password with a choice of X different characters for each ... takes using all upper- and lowercase letters, ... I can see only two advantages of complex passwords: ...
    (comp.os.vms)
  • RE: Basic question
    ... If somebody else hasn't covered it already, I'll try to send out a Kerberos ... > Unicode character set and can be up to 128 characters long, ... > Pre-W2K user interfaces limits do not allow passwords to ... I believe that you are referring to *LM* hashes. ...
    (Focus-Microsoft)
  • Re: Paper & pencil password algorithm
    ... generator and generate a password as a permutation of a whole ... The advantage of a random sequence generator is that I can make my ... I can't imagine ever wanting passwords ... convenience I'll probably keep most of them between 20 and 50 characters ...
    (sci.crypt)
  • RE: Password statistics and standards
    ... If you shut off the storage of LM hashes, over 9 Characters will buy you ... Take a look at Perfect Passwords for some creative ideas: ... information about accounts which is helpful in telling me ... Norwich University ...
    (Security-Basics)
  • Re: US Military bans HTML in emails
    ... You mean like requiring 6-character passwords to now be "complex"? ... the need for non-alpha characters. ... I've seen passwords with zeros for O's and 3's for E's. ... What hacker ever think of that? ...
    (comp.os.vms)
Quantcast