Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw
 
PerlMonks  

RE: RE: Ethics of Passwords

by KM (Priest)
on Aug 16, 2000 at 17:12 UTC ( #28105=note: print w/replies, xml ) Need Help??


in reply to RE: Ethics of Passwords
in thread Ethics of Passwords

While I was stuck in traffic last night staring at license plates I thought of this post. This is a likely bad idea for a password scheme. Why? Because anyone who knows the scheme can more easily crack a password. If I know you will be using 0-9 in four places, and letters from a name for the rest, I know that if the name is Sam Jones there are only 17 (10 numbers 7 letters, since the s is repeated) possible characters per place, with only 4 of them being digits. So if the password was between 8 and N places, you can do the math to see the finite number of possabilites. And, as some of us know, people don't change easy to remember default passwords unless they are forced to :)

Cheers,
KM

Replies are listed 'Best First'.
RE: RE: RE: Ethics of Passwords
by randomblue (Beadle) on Aug 16, 2000 at 17:37 UTC
    You're right, of course.

    But I should have clarified my thoughts. Notice how I mentioned sticking non-alphanumeric characters into the mix? The scheme I mentioned would not work if it were used precisely every time. But I think it's a good general idea for generating passwords , at least for low-risk access, like desktop workstations in the marketing department.

    Take a pseudo-random mix of letters that's pronounceable or has a meaningful association in case it's forgotten, and add several arbitrary numbers that have a pattern (like 6786 or 1641), stick in a punctuation mark or two, and you have a decent, hard-to-break password. But that's just common sense, I guess.

    Of course, arbitrary-length passphrases are so much better and easier to remember...

      Take a pseudo-random mix of letters that's pronounceable or has a meaningful association

      I would worry that would end up being a dictionary word.

      and add several arbitrary numbers that have a pattern

      Patterns are easy to find (didn't you see the movie Pi? ;)

      stick in a punctuation mark or two

      Same as using numbers, simply have to add the punctuation marks into the cracking algorythm.

      I'm not knocking you here, just that it is like you are trying to contrive a password creation sheme which isn't random, has a finite number of possabilities (especially when you use letters only in a persons name), and whose patterns could be figured out. There is nothing better (that I know of) than simply giving a totally randomly generated password. When the user changes it to 'ilovecheese', is when there is a problem :) (of course you can set rules against that happening).

      at least for low-risk access, like desktop workstations in the marketing department.

      That isn't really low risk. I am sure Adidas would like the marketing info from Nike :)

      Anyways, we aren't talking about Perl now!

      Cheers,
      KM

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://28105]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (1)
As of 2022-10-01 14:27 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    I prefer my indexes to start at:




    Results (126 votes). Check out past polls.

    Notices?