Date: Thu, 16 Aug 2012 20:25:43 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Learn from 'Crack Me If You Can 2012'. On Thu, Aug 16, 2012 at 11:45:45AM -0400, Brad Tilley wrote: > The diceware word list is a list of 7500+ words used specifically for > pass-phrase creation. That would be a good list to start with as people do > use it to generate pass-phrases and have done so for many years: > > http://world.std.com/~reinhold/diceware.wordlist.asc We can/should try indeed, but somehow I expect that Diceware-generated word combinations correspond to a small fraction of total passphrases in use and that they're relatively strong (good randomness, too many words). This is similar to targeting passwdqc's generated word combinations. In fact, the latter will probably be more effective if my guess is right that they're more commonly used by now, mostly by non-security people (passwdqc is generally installed by a sysadmin or provided with a system, not installed by the end-users themselves), and often on weaker-than-intended hashes. passwdqc's default of random=47 assumes a decent hash type, but I suspect that a lot of systems are misconfigured and keep this default even along with relatively fast/saltless hashes. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.