Password Strength II

From: Chris Berry (compjma@hotmail.com)
Date: 06/28/02 

Date: 27 Jun 2002 23:48:19 -0000
From: Chris Berry <compjma@hotmail.com>
To: security-basics@securityfocus.com
('binary' encoding is not supported, stored as-is)

I've gotten quite a few responses saying no because the passwords I asked
about previously (theusgotbeatbygermany vs. VX.97tf) had dictionary words
in it, which is what I've always told my users in the past, however I was
doing some math and it makes it look different, maybe someone here can
point out my error.

In a brute force attack the longer password will always be better, we're
all agreed on that, however hackers are smarter than that and will try
dictionary and hybrid attacks first. So this is what I think the odds are
approximately:

VX.97tf has to be brute forced so 68^7=6x10^12 certainly a big number and
good to go in my book.

theusgotbeatbygermany doesn't have to be brute forced, and is susceptible
to a dictionary attack so instead of letters the possiblity is based on
individual words which is 6, the LC4 program standard dictionary has 29000
entries (approximately) so we're looking at 29000^6=5x10^26 A BIGGER
NUMBER! (not to mention making it impossible to store in a LM hash)

Am I missing something?

Relevant Pages

  • RE: SHA-1 vs. triple-DES for password encryption?
    ... when you deal with passwords. ... Cryptographers call an attack something that would work on say ... > triple-DES and SHA-1 algorithms available. ... By not using triple-DES there is no need to secure a key ...
    (SecProg)
  • Re: Netowrk Admin. Breach
    ... attack, but at the time it was a little beyond me. ... But my approach to network security is similar to his.....I look at ... no business knowing any of your sensitive passwords. ... demonstrated that using an account with no privs. ...
    (microsoft.public.windows.server.security)
  • Re: web browser security/hardening
    ... Never reuse any usernames, emails, or passwords ... cross site scripting is something the web sites you visit ... yourself...although disabling scripting anyway can thwart those attack ... The NSA has designated Norwich University a center of Academic ...
    (Security-Basics)
  • Re: confusion in ank.
    ... Because of how salt strings are factored into the key generation ... process, a dictionary attack based on ... passwords is going to have to incorporate specific salt strings -- ... were encrypted in a user's key or a randomized service key. ...
    (comp.protocols.kerberos)
  • Re: Creating a Password
    ... The devil is always in the details with security. ... > Whether it's a 'dictionary' or 'brute force' attack, ... > I will also agree that we're nit-picking the sentence "Such passwords can ... > only be cracked by means of brute force". ...
    (microsoft.public.security)