Re:Creating memorable and secure passwords
by excuse-me on Friday March 23, 2012 @02:25PM
(#3746455)
It depends.
The old method of cracking passwords was a dictionary attack. You take every 6 or 8 letter word, and all the O->0 i->1 etc variants, calculate the hashed password and store them.
In this case having a 64character pass phrase makes the dictionary impractical. As did having a random "$^FD^$@l^" type passwd.
The newer technique is to use a GPU or FPGA and simply try all possible 6 or 8 char strings and calculate the hash in real time at a billion tries/second. This means the random gibberish is no better than "passwd".
So even if you do have the full text of "war and peace" as your pass phrase there will be a shorter string that hashes to the same value and the GPU will find this collision first. Remember it doesn't need to find your passwd - just an equivalent one.
The old method of cracking passwords was a dictionary attack. You take every 6 or 8 letter word, and all the O->0 i->1 etc variants, calculate the hashed password and store them. In this case having a 64character pass phrase makes the dictionary impractical. As did having a random "$^FD^$@l^" type passwd.
The newer technique is to use a GPU or FPGA and simply try all possible 6 or 8 char strings and calculate the hash in real time at a billion tries/second. This means the random gibberish is no better than "passwd". So even if you do have the full text of "war and peace" as your pass phrase there will be a shorter string that hashes to the same value and the GPU will find this collision first. Remember it doesn't need to find your passwd - just an equivalent one.