[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 16 Aug 2012 20:25:43 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Learn from 'Crack Me If You Can 2012'.
On Thu, Aug 16, 2012 at 11:45:45AM -0400, Brad Tilley wrote:
> The diceware word list is a list of 7500+ words used specifically for
> pass-phrase creation. That would be a good list to start with as people do
> use it to generate pass-phrases and have done so for many years:
>
> http://world.std.com/~reinhold/diceware.wordlist.asc
We can/should try indeed, but somehow I expect that Diceware-generated
word combinations correspond to a small fraction of total passphrases in
use and that they're relatively strong (good randomness, too many words).
This is similar to targeting passwdqc's generated word combinations.
In fact, the latter will probably be more effective if my guess is right
that they're more commonly used by now, mostly by non-security people
(passwdqc is generally installed by a sysadmin or provided with a
system, not installed by the end-users themselves), and often on
weaker-than-intended hashes. passwdqc's default of random=47 assumes a
decent hash type, but I suspect that a lot of systems are misconfigured
and keep this default even along with relatively fast/saltless hashes.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
