Re: Secure Password Policy?



Neil wrote:
On 1/19/2006 3:41 PM, Sulaiman, Wilmar wrote:

Dear all,

I noticed that "best practice" for Minimum password length policy is
either 6 or 8 characters. I guess SANS institute considered a weak
password if it is less than 8 characters.


I would like to know where they derived the number (6 and 8 characters).
Is there any documentation to backup it up why the best practice for
minimum password length is set to 6?



Thus:
possible number of passwords = possible number of characters ^ number of
characters in password.
and:
time to crack = number of passwords / number of attempts per second

361 = 36/1000 = 0.036 seconds (which is faster than you can blink)
362 = 1296/1000 = 1.296 seconds
363 = 46656/1000 = 46.656 seconds
364 = 1679616/1000 = 1679.616 seconds (27 minutes)
365 = 60466176/1000 = 60466.176 seconds (16 hours)
366 = 2176782336/1000 = 2176782.336 seconds (25 days)

So as you can see, the amount of time really spikes up by adding the
number of digits in your password.

Mind you, password crackers today are many times faster than the example
I did above.  So, using a real numbers, security advisories have decided
that at 8 characters, it will take someone quite some time to crack the
password.  (And I just don't recommend 6 characters, too trivial in
today's day and age.)


And by having accounts lock, at least temporarily, after excessive failures brute forces can be made much less effective.

As the risk of the access increases, increase the lock time up to permanent locking.  3 attempts an hour will make that 6 char password work much better. ;)
36^6 = 2176782336/3 = 725594112 hrs (30233088 days)

--
*********************************
Brian L. Anderson
Darton College
Office of Information Technology
andersob@xxxxxxxxxx
---------------------------------


------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:


Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------



Relevant Pages

  • RE: Whitespace in passwords
    ... 60 possible characters and the password is 7 characters long. ... >> Hackers are concentrating their efforts on attacking applications on ... >> Check your website for vulnerabilities to SQL injection, ... >> scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Whitespace in passwords
    ... 60 possible characters and the password is 7 characters long. ... >> Hackers are concentrating their efforts on attacking applications on ... >> Check your website for vulnerabilities to SQL injection, ... >> scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • RE: Whitespace in passwords
    ... They also do not have a lot of the Extended ASCII characters: ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... > Hackers are concentrating their efforts on attacking ... Up to 75% of cyber attacks are ...
    (Pen-Test)
  • RE: Whitespace in passwords - now alt+xxx
    ... Subject: Whitespace in passwords ... 60 possible characters and the password is 7 characters long. ... >> Check your website for vulnerabilities to SQL injection, ... >> scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • Re: Whitespace in passwords
    ... input password is alphanumeric + special characters -- chances are strong ... >> Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping ... >> your website for vulnerabilities to SQL injection, ...
    (Pen-Test)