Re:WordPass – Hate passwords, love passphrases
by markhemmings on Monday April 14, 2014 @12:47PM
(#7587242)
True, account should be disabled after x number of bad guesses. But securing against a "brute force" attack for me is more a case of cracking hashes from a db dump. It's easy to churn though vast numbers of hashes in no time at all these days. Here things like hashing algorithm speed, number of iterations, unique salting and original password length all have a part to play.
Re:WordPass – Hate passwords, love passphrases
by equivrel on Monday April 14, 2014 @12:46PM
(#7587233)
Online bruteforcing is not feasible except for extremely weak passwords or sites with security vulnerabilities. What is feasible is bruteforcing stolen password hashes (think Adobe leak) or say a hard drive encrypted with a memorable password, and this is where secure passphrases come into play.
Re:WordPass – Hate passwords, love passphrases
by williamcotton on Monday April 14, 2014 @01:06PM
(#7587383)
Or better yet, deterministic public keys like is seen with bitcoin.
Re:WordPass – Hate passwords, love passphrases
by maxerickson on Monday April 14, 2014 @12:58PM
(#7587328)
The comic uses 11 bits per 'common word' to get to 44 (there are 11 little boxes by each word in the comic).
Underestimating that value isn't a bad thing.
So I guess it's still better but it seems like a pretty big oversimplification to assume a length of word (especially a uniform one) and it shouldn't be that much harder to calculate the actual value. Maybe I did something wrong, I don't know.
[1] http://news.bbc.co.uk/2/hi/uk_news/magazine/8013859.stm