Short passwords 'hopelessly inadequate', say boffins

[JMH]

The availability of password-cracking tools based on increasingly powerful graphics processors means that even carefully chosen short passwords are liable to crack under a brute-force attack.

A password of less than seven characters will soon be "hopelessly inadequate" even if it contains symbols as well as alphanumerical characters, according to computer scientists at the Georgia Tech Research Institute. The security researchers recommend passwords at least 12 characters long.

The number crunching abilities of graphics processors were recently applied to commercial password auditing and recovery tools from Russian developer ElcomSoft. It's a safe assumption that black hats are able to use the same type of technology for less laudable purposes. Richard Boyd, of the Georgia Tech Research Institute, told the BBC that the number-crunching capacity of graphics cards compares to those of supercomputers built only 10 years ago.

More -
Short passwords 'hopelessly inadequate', say boffins • The Register

 

[Bituser]

If my 21 digit alpha numeric passwords are inadequate, then I think somethings terribly wrong .
I used to have a habit of using short passwords like you just suggested not doing . Then my website got hacked and that was lesson learnt. Moral of the story, don't overreact and use super long passwords or very short ones .

 

[johnwillyums]

12, 21. Would it really make any difference with current technology. If they want to get in they will. It'll just take a few milliseconds longer surely?

 

[windows7user]

12, 21. Would it really make any difference with current technology. If they want to get in they will. It'll just take a few milliseconds longer surely?

By brute force, it would take around 1.75 times longer to crack a 21 alphanumeric password compared to a 12 alphanumeric password.

If people remember combinatorics from middle school, they would know that using a password with only alpha characters can substantially cut down the time required to crack a password. For example:

A 12 letter password using only alpha: 12*26! combinations or 4.8*10^27
A 12 letter password using alpha and digits: 12*36! combinations or 4.5*10^42

By mixing in numbers to your password, you increased the number of possible combinations by ~937,500,000,000,000 times.

 

[Barman58]

There are four character groups that should be included in strong passwords

Lower case letters
Upper case Letters
Numbers
& Symbols

with a 12 character passwords the combinations do grow substantially

Even the simple "password" is harder to crack when it's "pA$sw0rD"

 

[Jacee]

Use a 'made-up' phrase or sentence for a password, being sure to mix it up.

 

[BCXtreme]

I use an alphanumeric password, but it's a far cry from exceeding 12 digits. I do have a much longer numeric key that I use for super sensitive stuff. Personally, there should be no digit minimums on passwords (like sites that say at least 6 characters, or whatever), because that just serves to narrow down the number of possibilities a bruteforce hacker has to try. For example, security people say hackers often try dictionary words first. If a site requires you to have at least a 6-character password, then that eliminates all the words in the dictionary that are five letters or less (which REALLY narrows it down).

I think the best an average Internet user can do is a) choose a password that is both letters and numbers (and symbols if you like), b) choose a password that is not directly associated with your identity (no family members' names, no friends' names, etc), and c) never EVER let anyone hear/see anything about your password, not the length, not the subject, not a hint, NOTHING. By doing so, you will drastically reduce someone's chances of hacking it. Even telling someone how LONG your password is only serves to radically lower the number of tries it would take them to get in.

 

[arkhi]

Awww. I only have like 6 characters as a password. Makes remembering easier. Gee.

And my password is: ツღ金Ƹ̴Ӂ̴Ʒ

 

[CarlTR6]

Passwords are like locks; they don't deter the determined.

 

[Barman58]

Carl,

I prefer to think of them more like car and house alarms - they tend to stop the opportunist thief, and even the more determined is more likely to move along to the next more easily accessable target.

One other thing I tend to do is not advertise - full stealth on systems means that as far as the outside world is concerned my system does not exist. To use the above analogy - I draw the shades when I'm not at home

 

[smarteyeball]

4

Even the simple "password" is harder to crack when it's "pA$sw0rD"

Thanks Nigel - now I need a new password :sarc:

 

[Barman58]

Patrick,

I know - you hadn't changed it for weeks

 

[Airbot]

4

Even the simple "password" is harder to crack when it's "pA$sw0rD"

Thanks Nigel - now I need a new password :sarc:

Patrick,

I know - you hadn't changed it for weeks

Great.

Now that's the end of me being hacked into smarteyeballs stuffs.

Way. to. go. Nigel.

 

[smarteyeball]

Sorted - I changed it to Dr0ws$Ap. No-one will guess that


Hang on... Damn.

EDIT:

Great.

Now that's the end of me being hacked into smarteyeballs stuffs.

Way. to. go. Nigel.

Ah ha!

 

[Barman58]

That's OK Aaron - The keylogger's are still working, just don't tell Patrick

 

[smarteyeball]

I won't tell him either

Wait a sec...

 

[BomberAF]

I think another important feature which should be used more often and is used in my bank is you only have 3 attempts to enter your pin number correctly, if you fail the 3rd time then you are blocked from getting access to your account until you contact the bank.

 

[Tepid]

Well,, for home users, that would be ok if they would remember to create or given the password recovery media for their systems.

but again, that is another security flaw that is not promoted strongly with home users.

At the same time, the largest majority of all users out there hate the idea of passwords and complain about the length and complexity of letters and numbers that must contain at least 1 capital letter and one number.
Throw a special character in there and their heads would explode. I get asked all the time, "can I just give you one to use?" ,, "No, sorry, it won't let us do that. you can not use any of the last 13 passwords." (which at a 90 day time frame is a little over 3 years). And some of them HAAAaaatttttee and LLLLllloooaaattthhhh that idea.

psst, hey, we can set any password you want, but I won't do it. so stop asking.

so, what do they do, at almost every place I have worked at? Write in on a sticky and slap it on their laptop keyboard area (or write it in sharpy on palm rest) that is PGP encrypted. Smart.

 

[EnNajmy]

12, 21. Would it really make any difference with current technology. If they want to get in they will. It'll just take a few milliseconds longer surely?

By brute force, it would take around 1.75 times longer to crack a 21 alphanumeric password compared to a 12 alphanumeric password.

If people remember combinatorics from middle school, they would know that using a password with only alpha characters can substantially cut down the time required to crack a password. For example:

A 12 letter password using only alpha: 12*26! combinations or 4.8*10^27
A 12 letter password using alpha and digits: 12*36! combinations or 4.5*10^42

By mixing in numbers to your password, you increased the number of possible combinations by ~937,500,000,000,000 times.

Interesting ! , I'm sure adding symbols will make it even harder to crack a password.

 

[EnNajmy]

Passwords are like locks; they don't deter the determined.

You're right , especially if the determined has the key