Microsoft says mandatory password changing is “ancient and obsolete” (2019)

Re:Microsoft says mandatory password changing is “ancient an... by gerdesj on Monday April 19, 2021 @06:22PM (#26868544)

Well OK but not all passwords are hex numbers! Given that testing a few simple classes the length of the shorter one takes about a second or two then that seems worthwhile.

It's been a while since I fired up John the Ripper but it has low hanging fruit modes built in.

So even if you are using quite long simple alphanum strings of gibberish then seriously consider adding one or more character class into the mix eg capitals and easy to identify special chars like $£% etc.

To really go for gold why not mix entire scripts eg the usual en_* alphabet and say Bulgarian Cyrillic. Gasp as your keyboard mapper explodes! Alternatively, look into MFA.

[ Parent | on HN ]

Re:Microsoft says mandatory password changing is “ancient an... by dlubarov on Monday April 19, 2021 @06:35PM (#26868645)

Yeah -- I assumed that a random hex password was chosen, and that the attacker does a brute force hex search (e.g. JtR with Incremental:LowerNum). Granted, in practice the attacker usually doesn't know the exact format, so they might waste additional time searching other formats.

I agree about incorporating other characters. As long as it's not "Dictionaryword1!" :) https://youtu.be/aHaBH4LqGsI

[ Parent | on HN ]