homepage Forums SimHQ Community Community Hall Time called on 8 digit passwords.

Researchers have built a Linux PC that takes just 5.5 hours to crack every possible eight-character password � including those containing upper- and lower-case letters, digits, and symbols:

http://arstechnica.com/security/2012/12/...ord-in-6-hours/

Meh, I'm sure the NSA and FBI have had one of those PC's for a while now.

Can I get one? I forget my password occasionally...

Everytime i forget my passwords, i send a msg to NSA or GCHQ. No problem.

Two step verification (by text) or the use of a password and token would be able to defeat that, I would think....and hope.

My bank allows my password to be a 4 digit code followed by a token number that changes every 60 seconds.

The password is pretty much outdated. Whether it's easy to remember or not, it's about the same for a computer to crack.



The Jedi Master

Why haven't retinal and other biometric authentication methods become more widespread? I guess cost?

And reliability. A glitch can lock you out.

The USAF had retinal scanners at Cape Canaveral back in the 90s I think but they failed so often they dumped them for ID cards you swiped w/PINs.




The Jedi Master

I ask Matt Wagner.

Anything is able to defeat this. The article is highly sensationalist. The only particularly new thing here is the speed at which they generated each of the hashes.

It a) has nothing to do with password length, a 400 letters long password password would generate the same length in a hash and b) won't work in real life because pretty much 100% of the time NTLM authentication is done with a remote server. Which they of course didn't use, otherwise they wouldn't be able to achieve that speed.

What they did here is pretty much the same thing that has been done for ages. Attack the hash/key/you-named that is generated from people's passwords. That's why 64-bit algorithms are not used any more, that's why Microsoft Office's RC-40 was vulnerable, and that's the way encryption algorithms work. All of them. The name of the game is "delay" and not "prevent" breakage.

Yep, that attack requires them to get the password file first. Which is possible, but not so easy.

In any kind of client/server scenario the server will block repeated guesses, deactivate the account etc.

As the article says there are also newer hasl algorythms.

The best password to use is "incorrect".
This way, if you forget it or type it in wrong, the computer will remind you.

There you go.

https://xkcd.com/936/

The internet is hell for a paranoid like me. I just got into the IT thing a few years ago and really can't keep up or am losing interest in keeping up.

It's like a stupid house. A determined person will find ways to get in. Smashing windows or with lock picks, maybe a freaking battering ram if no one's around. Eh while were at it, throw in some plastic explosives used by SWAT teams to break in.

Right now my stance is to get the basics right. The rest is trying to stay under the radar and not be a target.

Notice it is able to crack Windows passwords, not ALL 8 digit passwords. WINDOWS passwords.

Windows is notorious for poor choices regarding encryption and security.

For example, Windows 7 uses MD4 encryption for passwords. This encryption method is SERIOUSLY outdated and was already insecure at the time Windows 7 was introduced. People have been cracking and bypassing them for years.


But one other thing...Windows passwords are useless. All someone needs to do is access your computer with a USB drive with Linux or some other OS on it. They can then see your entire hard drive. The Windows password only stops people from logging in, it does not encrypt your data. It is basically completely useless.

If you are paranoid about security, do an encrypted disk install of Linux and set a long, complicated password generated randomly.

I personally have an encrypted disk Kali Linux installation and I use the Tor browser and Tor network whenever I want to remain anonymous and secure, for example when discussing Japanese politics (JP government has been known to "disappear" people who oppose certain actions it has been conducting recently)

Using the Tor browser with a bridge is pretty much guaranteed security especially if you only use it at random wireless access points, even more so if you uhh...acquire the wireless keys outside of conventional means.

If you are a normal person who's not active in political leaks or you're not handling huge amounts of money, online privacy is not really something you should worry about. Hackers / Russian mob etc. do not care about you. They have higher priority targets. You should worry more about your computer being turned into a zombie for a botnet than worry about whether your name and address are somewhere online.

Reminded me of the Kali installation I still have on my laptop. Didn't remove it after the contract that required its use was finished.

Hmmm maybe I should take it for a spin just for fun... will need to review some basics.

Yes, I also keep reminding myself that I'm a nobody and hackers etc. have higher priorities. However, with my close relative's emails hacked, including acquaintances (almost everyone around me), I wish I could be 100% sure.

My password is invalid.

So I will never forget it.