RE: ADS Password Storage Protection

My conjecture is that franklyidon'tgiveadamn is pretty uncrackable as
well. No complexity, but length prevents it from being easily
broken...non-trivial. Pull out the complexity and the length is still
insurmountable in most cases.

If you don't believe that then break my 123456789012345 length, no
complexity challenges.

-----Original Message-----
From: Depp, Dennis M. [mailto:deppdm@xxxxxxxx]
Sent: Tuesday, July 18, 2006 8:36 AM
To: winshel@xxxxxxxxxxxxxxxxxx; security-basics@xxxxxxxxxxxxxxxxx
Subject: RE: ADS Password Storage Protection

The phrase you gave, "frankly, my dear, I don't give a damn" meets most
definitions of complexity. I has upper and lower case letters and
special characters.

Dennis

-----Original Message-----
From: winshel@xxxxxxxxxxxxxxxxxx [mailto:winshel@xxxxxxxxxxxxxxxxxx]
Sent: Saturday, July 15, 2006 12:25 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Re: RE: ADS Password Storage Protection

I've read and heard many sources say this same thing, i.e., that, for
windows systems, length is stronger than short and complex. And that a
15 character or longer password can be a real phrase and it will be a
secure password.


I can see why a long password that consists of a real phrase - such as
"frankly, my dear, I don't give a damn" - would be just as secure as an
equally long complex password, in terms of protection against a brute
force attack.


I don't know much about password cracking programs but am surprised
that, while they would be working on a brute force attack, they
wouldn't be able to try a lot of commonly-used phrases at the same time.


If some password cracking programs can use a dictionary attack, couldn't
there also be something called a passphrase attack? Would it be
difficult for a password cracker to digitize Bartlett's Book of
Quotations and include that in an attack on a password?

------------------------------------------------------------------------
---
This list is sponsored by: SensePost

Hacking, like any art, will take years of dedicated study and practice
to master. We can't teach you to hack. But we can teach you what we've
learned so far. Our courses are honest, real, technical and practical.
SensePost willl be at Black Hat Vegas in July. To see what we're about,
visit us at:

http://www.sensepost.com/training.html
------------------------------------------------------------------------
---


------------------------------------------------------------------------
---
This list is sponsored by: SensePost

Hacking, like any art, will take years of dedicated study and practice
to master. We can't teach you to hack. But we can teach you what we've
learned so far. Our courses are honest, real, technical and practical.
SensePost willl be at Black Hat Vegas in July. To see what we're about,
visit us at:

http://www.sensepost.com/training.html
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------

Relevant Pages

  • RE: ADS Password Storage Protection-$100 reward to crack my password hashes
    ... characters and do character substitution using words instead of letters ... when doing a dictionary attack. ... complexity in their passphrase. ... Clues Normal Password Cracker Would Not Have: ...
    (Security-Basics)
  • RE: ADS Password Storage Protection
    ... If length is the tool for a secure windows passphrase then, in theory, a password of "aaaaaaaaaaaaaaa" should be just as strong as a 15-character password consisting of random characters? ... No complexity, but length prevents it from being easily ... that, while they would be working on a brute force attack, they ... Hacking, like any art, will take years of dedicated study and practice ...
    (Security-Basics)
  • RE: ADS Password Storage Protection
    ... treat each word as character, and apply varying combinations of those ... But if one was created, mathematically, a passphrase only using words ... way to guarantee real complexity on shorter passwords. ... its hybrid attack. ...
    (Security-Basics)
  • RE: ADS Password Storage Protection
    ... best analysis has concluded that length beats complexity every time. ... A passphrase attack doesn't scale well, even when only using the average ... Norwich University ... EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The NSA has ...
    (Security-Basics)
  • Re: Reading Monte Cook: Legends and Lore
    ... Monte digs further into his complexity pie. ... attack, rather than having a proxy for that you had to look up or learn. ... can you retreat without an AoO? ... low level play at +10 to attacks and defenses, ...
    (rec.games.frp.dnd)