btchris
|
|
April 21, 2015, 03:49:31 PM |
|
i don't know who is right, but with "my name is" the first that i posted say 3 hours, instead your say 1 year approximately also it say crack time 35M seconds which is about 1 year and then crack time display 3 years? are those two not the same thing? I don't understand.... when I try "my name is" in the one I linked above (zxcvbn), I get back 5 hours. More on point, it turns out the first one (my1login.com) is using the same underlying zxcvbn javascript library (but maybe a different version of it). Regardless, the answer to "who is right" is: nobody. As the article I linked above discusses, estimating crack times of a password is very hard, and often attackers have access to resources (e.g. gigantic n-gram tables) which are just too impractical for javascript checkers like these to include.
|
|
|
|
Bitcoin Explorer
|
|
April 21, 2015, 04:01:52 PM |
|
Have a look at this, its quite good, but you should consider skipping substantial parts. You should have all types of characters, which are: 1. Upper case 2. Lower case 3. Numbers 4. Special characters
Moreover, you should make it quite long
|
|
|
|
virtualx
|
|
April 21, 2015, 04:20:45 PM |
|
10 characters, 20? 25?
Letters, numbers, special characters?
What if a user used only letters and numbers for example?
Say a hacker gets a wallet.dat with the pass-phrase helloworld, would it break in seconds? Now what if it is helloworld!~~ or HelloWorld!~~!
Are all these "weak" pass-phrases?
What if the wallet is than also backed up online which is known as a bad practice. What are the implications of that?
The search space increases with 20, 25. Bad guys use rainbow tables, dictionary attacks, brute force and everything they can find. Do not use phrases like 'helloworld' and little variations of that because they are compromised. Expect bad guys to try 10.000 passwords or more per second. Some scientific papers on this issue: All in a day's work: Password cracking for the rest of us http://www.sintef.no/upload/IKT/9013/dayswork.pdfPassword Strength: An Empirical Analysis http://www.eurecom.fr/~michiard/downloads/infocom10.pdfProactive Password Strength Analyzer Using Filters and Machine Learning Techniques http://www.ijcaonline.org/volume7/number14/pxc3871788.pdfThe conclusion of one of the papers: The password as an authentication mechanism is headed for obsolence, as the password lengths required to thwart rainbow table attacks are rapidly approaching unmanageable (or unrememberable) proportions. Pick a password as random and long as a bitcoin address and you should be good for now. If you have backed up online then at least one person other than you has access to your wallet file.
|
...loteo...
DIGITAL ERA LOTTERY | ║ ║ ║ | | r | ▄▄███████████▄▄ ▄███████████████████▄ ▄███████████████████████▄ ▄██████████████████████████▄ ▄██ ███████▌ ▐██████████████▄ ▐██▌ ▐█▀ ▀█ ▐█▀ ▀██▀ ▀██▌ ▐██ █▌ █▌ ██ ██▌ ██▌ █▌ █▌ ██▌ ▐█▌ ▐█ ▐█ ▐█▌ ▐██ ▄▄▄██ ▐█ ▐██▌ ▐█ ██▄ ▄██ █▄ ██▄ ▄███▌ ▀████████████████████████████▀ ▀██████████████████████████▀ ▀███████████████████████▀ ▀███████████████████▀ ▀▀███████████▀▀
| r | | ║ ║ ║ | RPLAY NOWR
BE A MOON VISITOR! |
[/center]
|
|
|
btchris
|
|
April 21, 2015, 05:59:07 PM |
|
The conclusion of one of the papers: The password as an authentication mechanism is headed for obsolence, as the password lengths required to thwart rainbow table attacks are rapidly approaching unmanageable (or unrememberable) proportions. I admit I didn't read the referenced papers, however that conclusion is ridiculous. A simple 8+ byte random salt as already used by most* Bitcoin wallet software today easily defeats rainbow table attacks. * Electrum (1.x and 2.x) and MultiBit HD are two notable exceptions of wallets which don't use salt.
|
|
|
|
pooya87
Legendary
Offline
Activity: 3598
Merit: 10930
|
|
April 21, 2015, 06:06:45 PM |
|
this is a cool link, i bookmarked it for later references. and according to it the kind of passwords i use will require 8 quintillion years to be cracked by a desktop pc
|
Bitcoin is the only decentralized money in existence.
|
|
|
pedrog
Legendary
Offline
Activity: 2786
Merit: 1031
|
|
April 21, 2015, 07:20:56 PM |
|
you can try this, to see how strong your password is https://howsecureismypassword.net/usually something with 10-12 is good enough, just change the combination for every site The kind of passwords I use: It would take a desktop PC about 285 nonillion years to crack your password
"It should be pretty safe."
|
|
|
|
btchris
|
|
April 21, 2015, 07:27:43 PM |
|
this is a cool link, i bookmarked it for later references. and according to it the kind of passwords i use will require 8 quintillion years to be cracked by a desktop pc ...and... The kind of passwords I use: It would take a desktop PC about 285 nonillion years to crack your password
Don't put your faith in password estimators (read the rest of this thread), but if you insist on doing so, at least use one of the others mentioned here. howsecureismypassword.net isn't very good. edit: actually, it's terrible. For the password "passwords99", it has an estimate of 1 year! zxcvbn estimates that same password at 16 seconds, much better.
|
|
|
|
pedrog
Legendary
Offline
Activity: 2786
Merit: 1031
|
|
April 21, 2015, 08:45:57 PM |
|
The kind of passwords I use: It would take a desktop PC about 285 nonillion years to crack your password
Don't put your faith in password estimators (read the rest of this thread), but if you insist on doing so, at least use one of the others mentioned here. howsecureismypassword.net isn't very good. edit: actually, it's terrible. For the password "passwords99", it has an estimate of 1 year! zxcvbn estimates that same password at 16 seconds, much better. Checked with zxcvbn at https://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htmlentropy: 123.233 crack time (seconds): 6.247157023824979e+32 crack time (display): centuries score from 0 to 4: 4 calculation time (ms): 23
|
|
|
|
Lorenzo
|
|
April 22, 2015, 07:00:07 AM |
|
12 letter is enough, if you combine both upper & lower case, numbers and special characters. See my wifi password below: U>u^ZT[jehlNz this password might take years to brute force (even with super computers). But the thing is you've to remember you password. And change your password frequently.
~Rude Boy
It's certainly very safe today but it might not be so safe in the future. According to Amph's link, that password would take about 100 million years to crack using a desktop PC. Moore's law states that processing power doubles every 18 months so after 35 years, we would have ((2050-2015)*12)/18 = 23 doublings. 100 million years halved 23 times is 11 years. Now imagine a supercomputer that is 1,000 times more powerful than a desktop PC and your password could then be cracked in days.
|
|
|
|
Mountain Jew
Member
Offline
Activity: 60
Merit: 10
|
|
April 22, 2015, 10:42:45 AM |
|
It just needs to be strong not ridiculously long. The longer or more complex it is the more likely you'll forget it. Keeping your wallet safe and your over safety of your comp is most important. If you have a key logger it doesn't matter what your password is as they'll know it immediately.
|
|
|
|
ranochigo
Legendary
Offline
Activity: 3038
Merit: 4420
Crypto Swap Exchange
|
|
April 23, 2015, 01:46:30 PM |
|
It just needs to be strong not ridiculously long. The longer or more complex it is the more likely you'll forget it. Keeping your wallet safe and your over safety of your comp is most important. If you have a key logger it doesn't matter what your password is as they'll know it immediately.
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
|
|
|
|
funnycoin
Member
Offline
Activity: 61
Merit: 10
|
|
April 23, 2015, 04:30:00 PM |
|
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
Can the keylogger get my password if I copy-and-paste it (no typing)?
|
|
|
|
Amph
Legendary
Offline
Activity: 3248
Merit: 1070
|
|
April 23, 2015, 04:35:27 PM |
|
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
Can the keylogger get my password if I copy-and-paste it (no typing)? yes, you need to use the keyboard of your pc(virtual keyboard) or typing it in a way to camouflage it(for example, your password is "my name is", instead you write my.name.is, then you delete those two dot, using the mouse) use zemna antikeylogger free, it help a lot
|
|
|
|
randy8777
Legendary
Offline
Activity: 896
Merit: 1000
|
|
April 23, 2015, 04:43:59 PM |
|
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
Can the keylogger get my password if I copy-and-paste it (no typing)? yes, you need to use the keyboard of your pc(virtual keyboard) or typing it in a way to camouflage it(for example, your password is "my name is", instead you write my.name.is, then you delete those two dot, using the mouse) use zemna antikeylogger free, it help a lot so even if i generate a password with a pass generator it can still be seen by keyloggers? what if you disconnect your pc from the net while setting a password? is that better?
|
|
|
|
Muhammed Zakir
|
|
April 23, 2015, 04:49:17 PM |
|
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
Can the keylogger get my password if I copy-and-paste it (no typing)? yes, you need to use the keyboard of your pc(virtual keyboard) or typing it in a way to camouflage it(for example, your password is "my name is", instead you write my.name.is, then you delete those two dot, using the mouse) use zemna antikeylogger free, it help a lot You know there are mouse loggers, right? so even if i generate a password with a pass generator it can still be seen by keyloggers? what if you disconnect your pc from the net while setting a password? is that better?
It depends on how your keylogger does the job. Some keyloggers try to upload/share instantly which can be prevented if you are offline but some save the log and upload/share as soon as you connect to internet which can't be resolved without removing them. Most of the keyloggers are infected in pirated OS copies.
|
|
|
|
Amph
Legendary
Offline
Activity: 3248
Merit: 1070
|
|
April 23, 2015, 04:57:27 PM |
|
The keylogger will only get your password if you type it in. It won't know it immediately when infected. If you are using the passphrase to create a password, you would definitely need a random password that is seriously random. You can try to recite it to yourself three times per day or write it down on somewhere safe. If you are encrypting wallet keys, password will only protect you in the event of someone gaining control of your PC.
Can the keylogger get my password if I copy-and-paste it (no typing)? yes, you need to use the keyboard of your pc(virtual keyboard) or typing it in a way to camouflage it(for example, your password is "my name is", instead you write my.name.is, then you delete those two dot, using the mouse) use zemna antikeylogger free, it help a lot You know there are mouse loggers, right? yeah but it doesn't change that a logger memorize every characters you type, in sequence...., so their password in that case would be the first plus two "back space" and two underline of the mouse, resulting in 14 characters in total, versus the original 10
|
|
|
|
|