News for hackers. Stuff that matters.
Re:Microsoft says mandatory password changing is “ancient an... by moron4hire on Monday April 19, 2021 @04:50PM (#26867825)
With passwords that simple, it's crackable almost instantaneously without any preknowledge of the password format. That, coupled with the fact that systems get randomly attacked all the time, I doubt it's really that big of a deal.

Attackers don't need hints on passwords, they don't need hints on targets. They just target everyone, and try all easy passwords.

Re:Microsoft says mandatory password changing is “ancient an... by hsbauauvhabzb on Monday April 19, 2021 @05:26PM (#26868146)
It depends on the context, if I have a hash it’s trivial to crack dictionaryword29, if I’m brute forcing a VPN/RDP endpoint, generally fail2ban are hard enough to block mass attempts (an AD default, iirc), the latter is usually solved by phishing which has the added benefit of MFA capture also.

Pentester here, to clear any dubious assumptions.

Re:Microsoft says mandatory password changing is “ancient an... by ivalm on Monday April 19, 2021 @06:14PM (#26868486)
But if the password is salted is it still easy to crack?
Re:Microsoft says mandatory password changing is “ancient an... by tracker1 on Monday April 19, 2021 @06:37PM (#26868655)
Yes... there are lists that are generally used for common variants of passphrases and can generally crack a simple passphrase like ggp in less than a day easily, faster or slower depending on hardware in use, concurrency and order.

4-5 dictionary words with proper sentence structure is a lot safer for the most part. Random safer still, but much harder to remember... my current password for work in a sentence with 24 characters. spaces, capitals and punctuation. Other than my OS and password manager, I really don't remember any other passwords I use, and the majority are random generated at this point.

I also use a wildcard mail forwarder, so most new sites I've used in the past year or two are all unique emails as well.

Re:Microsoft says mandatory password changing is “ancient an... by hansvm on Monday April 19, 2021 @06:35PM (#26868643)
Yes, definitely. The salt just means you have to compute a few hashes yourself rather than relying on a lookup table.