Re: Secure Password Policy?

On 1/19/2006 3:41 PM, Sulaiman, Wilmar wrote:
> Dear all,
>
> I noticed that "best practice" for Minimum password length policy is
> either 6 or 8 characters. I guess SANS institute considered a weak
> password if it is less than 8 characters.
>
> I would like to know where they derived the number (6 and 8 characters).
> Is there any documentation to backup it up why the best practice for
> minimum password length is set to 6?
>

Well, the amount of time it takes to brute force a password goes up
exponentially with every additional digit.

Suppose we are using alphanumeric passwords, which would give us a
possible 36 characters for each digit of the password. (Alphanumeric is
what is often touted to normal users in security lectures in my experience.)

Let us also suppose that we can attempt 1000 passwords a second (a
number which has no basis in fact, but is nice and round).

Thus:
possible number of passwords = possible number of characters ^ number of
characters in password.
and:
time to crack = number of passwords / number of attempts per second

361 = 36/1000 = 0.036 seconds (which is faster than you can blink)
362 = 1296/1000 = 1.296 seconds
363 = 46656/1000 = 46.656 seconds
364 = 1679616/1000 = 1679.616 seconds (27 minutes)
365 = 60466176/1000 = 60466.176 seconds (16 hours)
366 = 2176782336/1000 = 2176782.336 seconds (25 days)

So as you can see, the amount of time really spikes up by adding the
number of digits in your password.

Mind you, password crackers today are many times faster than the example
I did above. So, using a real numbers, security advisories have decided
that at 8 characters, it will take someone quite some time to crack the
password. (And I just don't recommend 6 characters, too trivial in
today's day and age.)

--
Neil.
http://voidfx.net
"Lord, grant me the strength to accept the things I cannot change, the
courage to try to change the things I can, and the wisdom to hide the
bodies of the people I had to kill because they pissed me off."
--Anonymous

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------

Relevant Pages

  • Re: Secure Password Policy?
    ... There really isn't a "best practice" to password length in generic terms. ... Passwords stored or sent in LM can be up to 14 characters, but the password is stored as two independent 7 character hashes. ... Then again, even with a 14 character NTLM password, rainbow table attacks can be successful in very short periods of time. ... KPMG Siddharta Siddharta & Widjaja ...
    (Pen-Test)
  • RE: Secure Password Policy?
    ... > I noticed that "best practice" for Minimum password length ... > considered a weak password if it is less than 8 characters. ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Writing Trauma
    ... are writing today really *is* noticeably better than what you wrote last ... skill faster than your Creative Writer -- meaning, ... Writing gets better with practice. ... the point of view of the characters, only that he picked up and moved to ...
    (rec.arts.sf.composition)
  • Re: Liquidity of words/Revision report
    ... >> characters; they haven't turned up yet other than a brief cameo. ... Doing a rolling revision helps - I'm making myself go back to earlier ... characters, the events, the setting, so even with the polishing efforts, ... > good odds that after some amount of practice, ...
    (rec.arts.sf.composition)
  • Re: question about 4.2 Multiplication in AES document(FIPS 197)
    ... > If you're not concerned with portability then of course you ... In practice at the moment - until the fixed length integer type headers ... to use 8-bit characters - which are highly portable in practice. ... Brian Gladman ...
    (sci.crypt)