Printable View
Hey Greg,Quote:
Originally posted here by hot_ice
Man, that's gonna take a while to type out, no one will be able to break it, too many digits mate. I just use 123, it's good enough for me. :)
Greg
BTW, what is your IP number and could you provide me with a list of services that you have running on your box? JUST kidding! :D
b1n2n3 would also be quite good... A's are replaced by incrementing numbers... But just "banana" would also be good enough unless a brute-forcer is used against it. No-one will manually try every English word...
On a serious note, (lol) I use three random letters plus my student ID number at school (I knew it'd be used for something :-D ) My student ID is 8 digits so it's moderatley hard to get through with three random letters before it.
actually 1337 speak is pretty good for passwords...Quote:
i could see b4n4n4 a safer password
This from another thread would be a very difficult pwd to brute force...
1337Sp3/\|<?1337=L@/\/\£®
upper & lower case, punctuation and a non standard characters...this would easily meet most complexity requirements...
:) I was having a convo about using 1337 speak for passwords the other day with a friend. Which is one reason why I suggested b4n4n4.
Like most sane people know, strong passwords contain letters, numbers, and other odd-ball characters. Most people can't remember several different strong passwords which are 8+ digits long.
Enter 1337 sp34k
Easy enough to remember. 3= E, 4= A.
Now you can make your current pass-phrase just that much stonger when using 1337 sp34k.
There are dictionary files that will check certain types of k-rad. I have seen some passwords that looked quite good get cracked with some of these.
ie> d0lF1N *a1B2c3*
Some program (can't remember which one) will automatically convert a dictionary file to k-rad as it goes.
There's probably a crypt script/dictionary out there to do it, among others.Quote:
Originally posted here by souleman
Some program (can't remember which one) will automatically convert a dictionary file to k-rad as it goes.
Also, remember, that many of these passwords made strong purely by length... stupid OS' like Solaris tend to only count the first eight characters of the password and ignore the rest, so the password with three numbers followed by and eight digit student ID would basically then be reduced to eight numbers - significant reduction in strength, there (not to mention that it's composed of some personally identifiable or "guessable" information, perhaps weakening it even more in some respects).
Taking into account, of course, that most people can't spell banana to begin with and you can see why they would think it's a safe password.
DOH!
My passwords are a random combination of Letters, numbers and signs. About 25 characters long like: 4g8D.;4+47wHÃL'a"gj5/}R@)da, but don't tell anyone, I trust you guys so don't tell my password to anyone! :)
The way that I weed out weak passwords is to run John the Ripper over my /etc/shadow file. If JtR can't crack it, then it's a safe bet that the passwords is pretty good. I also tweak the JtR default settings and use a bigger dictionary file because the default dictionary file is pretty small. It should be noted that JtR checks for h4x0r spellings too (eg hotdog = h0tD0g).
The way that I choose passwords is to choose a line from a song that I like and abbreviate it somehow to form a password. It's easy to remember the password because you can just hum the song. Songs stick in your head a lot more easily than a bunch of symbols. Plus the password is going to be pretty strong (it helps that I have an obscure taste in music.)
Here's an example password. If you can guess the song I will give you a prize.
l2ts@n&d^
And yes banana is in the default JtR dictionary. It takes less than a second to crack :)