Printable View
For newbies like me, lazy peoples and security obsessed persons, here is an easy way to create a really strong password.
http://www.makepassword.com/
how 'bout a 29 characters long password with uppercases and numbers. :D
D0Yenon0KiesR1Yierbl0Miumah3T
And remember tht how ? hahah I can make a password like that myself...
1Vfg2655Jlkoifo98vb28vnHdnmaI
Where's the special chars?Quote:
Originally posted here by ©opy®ight
And remember tht how ? hahah I can make a password like that myself...
1Vfg2655Jlkoifo98vb28vnHdnmaI
/me cracks your password.
nice site chizra. Easy to use, simple interface. Just something about on-line password generators always skeeved me.
I don't know when I hit that "Make Password" button, that somewhere...my newly generated password plus my IP address aren't stored in some database. I think I'm being a bit over-analytical here (I admit it) when I say, I simply don't trust any online password generator.
If I'm stupid enough to not secure my system, this person now has my IP address, along with whatever other information my browser sent to their server, and a possible password I may use on my system for personal/sensative/financial etc. documents. It's just me, but I don't like it.
Anyways, it's still a cool site and I think I'm just being anal. good job. :D
I gotta go with shag on this one. Not to mention for the average n00b or even "guru" nobody is going to remeber that hellacious thing. Alot of windows based stuff doesnt even support passwords that long AFAIK. The kind of data a password like that is designed to protect some n00b isnt going to have acsess too. The only thing the target of this post is going to do is piss off thier IT guy by constantly asking for thier password to be reset
This site looks like it pulls words from the dictionary then replaces one or two...not really the greatest, not to mention that uppercase and numbers should be checked by default. Wheres the option for special characters?
And personally, if you're using passwords that long then you are going to find out the hardway about social engineering, because that little yellow sticky under your keyboard isnt quite as hidden as you think. Also...if you're calling me to reset your password several times a month, let alone several times a week, you're REALLY going to be pissing your badass IT manager off..
edit: ok seriously, i looked at a few of the words. Take noplium for example. EVERY letter is on the right side of the keyboard...Strong? not hardly. They're not all that bad, but alot of them have 2-3 letters on one side, then one on the other, then 2-3 back on the original side, not good.
Actually, there is a nice, tidy, and 'secure' C# progam (code) hanging out here . I have found this to be fast and effective.
Plus, you wrap the 'meat' up in a list fed array and wallah, you have new passwords for n number of systems/users.
Quite handy if the mundane task of changing passwords should ever happen to cross your desk.
I have to agree...while the site may seem nifty and legit, who is to say that it isnt just another 'scam' of sorts....Quote:
Originally posted here by ShagDevil
nice site chizra. Easy to use, simple interface. Just something about on-line password generators always skeeved me.
I don't know when I hit that "Make Password" button, that somewhere...my newly generated password plus my IP address aren't stored in some database. I think I'm being a bit over-analytical here (I admit it) when I say, I simply don't trust any online password generator.
and as stated, its easy to make some gibberish password.....the question is, will you remember it w/o tattooing it to the back of your hand?
Too hard to remember for us that might have gray moments. so I prefer abreviating phrases with characters, upper and lower cases and so on.........
Oh! You ate a two pound bee, I see
O!u8a2#b,Ic
or something like:
4u&Ir2b1nAc!
Be creative with all the characters and single letters representing a whole word, etc. (next to a case of Foster's, this will help keep your admin happier :))
cheers
It really does come down to whatever really works for you. Each person has their own methods. The phrases seem to be the most popular.Quote:
Too hard to remember for us that might have gray moments. so I prefer abreviating phrases with characters, upper and lower cases and so on.........
I worked with an elderly sys admin deity who had memorized entire verses of poetry and would create personal passwords from them in the same manner in which you do with phrases. It just seemed somewhat phenominal that someone could actually remember a 20+ character password including special characters...
So, once again, it comes down to whatever it is that works for you. Just be sure to follow the best practices set forth in the industry. And remember, even if you give your users obscure passwords, they will memorize them after a week or two of having to type them in 5+ times a day. That's just how a brain works. Truly amazing ;)
I take the view that a lot of password cracking tools are quite limited in the size of the password they will handle.
There is also the question of how long someone will continue to attempt a crack.
I generally recommend that newbies (or anyone else for that matter) use a "core password" and just expand it with some easily remembered characters something like this:
€12345"core password"ABCDE$
;)
It is funny that you should mention that, as 90% of the installations I have worked on require that every 90 days all passwords will be changed. And it's tough enough to get that 'core' password to flow from your fingertips so everyone just adds a bit to the front and back ....
Very useful technique ;)
But, there are some 'evil' systems that 'know' what you're doing and state that this password is too similar to the old one. Grr.
i do not understand the concern over password complexity. according to my math if i extract my password randomly from the alphanumeric set plus the shifted numerics i will only need a password four entities long to satisfy the ansi x9.9 standard which states that the odds of guessing an authentication response must be no greater than one in 1'000'000.
abcdefghijklmnopqrstuvwxyz + 0123456789 + !@#$%^&*()
yields 46 entities. a four entity password would contain 46^4 | 4'477'456 possible passwords.
given the normal three attempts before lockout policy featured by security minded organizations this number is divided by three for odds of one in 1'492'485. to reset the lookout the user must enter the correct authentication response twice consecutively. the first time will error as normal and quietly unlock the account. the user will then be notified of the login failures and can respond appropriately.
considering that password hashes are plaintext equivalent the cracking argument is not valid either never mind the fact that very privileged access must already be acquired to access the hashes in the first place.
passwords face five discrete threats.[list=1][*]guessing (resolved by a four entity password as shown above.)[*]brute force (resolved by limiting the attempts.)[*]perception management (still an unresolved issue not effected by password complexity.)[*]recording (resolved by ensuring system and channel integrity.)[*]emanations (resolved by ensuring environmental integrity.)[/list=1]mandating long or complex authentication responses does little to increase trustworthiness while increasing the occurrence of users handling passwords inappropriately and decreasing administrative vigilance to invalid authentication attempts.
Relyt,
Something like This ?
:)
I guess that catch is right........ it depends on the attack vector?
Three shots and you're out, is different from a hash download and all the time in the World?
;) :D