Group Policies anyone?

TrackBack — Fri, 16 Sep 2005 18:01:00 GMT

re: Choosing good passwords - correction - pass phrases

bradley — Tue, 25 Jan 2005 17:50:00 GMT

Don't be misled by anyone who suggests that the basic requirements of a strong password or using passphrases is going to prevent you from being cracked.

The main reason why people are cracked quickly and particularly over a network connection is because they're PREDICTABLE.

Yes.
If MS says for you to do something, it might get you past the point of being stupidly crackable, but it will still make you PREDICTABLE.
If I tell you to do something, if the cracker has foreknowledge of that information, it makes you PREDICTABLE.
If you construct your password like 99% of the rest of the world, you're PREDICTABLE.
If you use a default password, you're PREDICTABLE.
If you use a password which is used so often it's in a cracker's dictionary, you're PREDICTABLE.

So why does a hacker depend on predictableness? Because it means that he doesn't have to try every possibility. Because it means that he can throw out the 16 million or more possibilities of a "Strong Password" and crack your password within a few hundred or thousand tries by simply applying some rules based on PREDICTABILITY.

Why a Passphrase can suck and Strong Passwords aren't always so strong would take more than I'll want to post to a Blog, but if you make passwords according to the following you'll probably be plenty resistent to cracking

- Longer than 15 characters. Better yet, longer than 23.
- At least 2 of the 4 categories. 3 is not really critical, but can help and everything helps especially if the password doesn't change often or is critically important.
- Use at least one non-romantic language word. Know Russian? Arabic? Hebrew? Thai? Good stuff to include in a <long> password.
- Don't reference any information about you or your business such as addresses, dates, phone numbers, SSIDs, driver's licenses, hobbies and more. Although those might not be tried by an wide-ranging attack, all those items are easily discovered on the Internet and can be added to a cracker's dictionary if he's intent on just cracking <you>.

And, implement good password policy:
Change Passwords often. 42 days should be considered minimally sufficient. Monthly or better is <very> much prefered if your Users can tolerate it.
Impose good History. Especially if your password effectiveness is long, make sure they're not used, maybe in the same year.
"Three Strikes and you're Out!" - Don't let crackers hammer on you all day long. Limit consecutive failures before enforcing a timeout. I know a couple businesses who won't even tolerate one failure before lockout.

Tony

Passwords vs Passphrases

TrackBack — Tue, 25 Jan 2005 09:44:00 GMT