Password Security Question

[stryder144]

Is there some kind of tutorial or paper written on the relative strength of passwords based on types and numbers of certain characters employed? For instance, my root password is 28 characters long. 4 of the characters are special characters, 3 are numbers, 3 are upper-cased letters, and 18 of them are lower-cased. How can I tell how strong that particular password is?

Thanks,

Cheers

[praetorian]

wow! you're doing way better than i am. my root password is 8 characters.

Try downloading "John The Ripper" and try to crack your own password. I'm not sure if any other program that'd tell you how "strong" your pasword is. The best way to check IMO is to attempt to crack it.

[gorn]

I was actually surprised at how well john the ripper works. I mean for dictionary I knew it was fast, but for say a alphanumeric 7 letter password? It only took me like 2 weeks. It wasn't a bad password except for being so short, and all the same case, and no special characters.

[t048]

[quote author=stryder144 link=board=5;threadid=9082;start=0#msg82188 date=1082676169]
Is there some kind of tutorial or paper written on the relative strength of passwords based on types and numbers of certain characters employed? For instance, my root password is 28 characters long. 4 of the characters are special characters, 3 are numbers, 3 are upper-cased letters, and 18 of them are lower-cased. How can I tell how strong that particular password is?

Thanks,

Cheers
[/quote]

I don't have the link off hand, but I remember reading a paper that talked about how password longer than 12 or so letters suffered from diminishing returns.

But imagine that the password is case sensitive, then you have

lower-case letters = 26
upper-case letters = 26
numbers = 10
special characters = say, just 10 !@$%^&*()

26+26+10+10 = 72 possible characters.

Now imaging that the password is actually a base-72 number, then a 28-digit password would have 72^28=1e+52 possible permutations. That's a whole lot. A brute-force attack would require several thousand years to crack that, assuming it could try trillions every second.

[stryder144]

I'll give John a try. Sounds like it could be fun to see how long it takes to crack.

t048 - so a password that is longer than 12 characters is not inherently stronger than a 12 character password. Interesting. I'm not really certain why I chose a 28 character password, I guess it just seemed like the thing to do at the time.

Thanks

Cheers

[countach44]

I use sentences with numbers thrown in, I doubt I know how strong they are. Speaking of John the Ripper, what about good ol crack?

[KumaSan]

I always like diceware for picking passwords. The faq's got a good bit about what makes a good password, such as length, special characters, etc.

[Baron_Flambe]

Password security can be a double edged sword. Making passwords that are hard to guess by virtue of being esoteric also makes them hard to remember. Then it gets tempting to write them down.