RE: [WEB SECURITY] Passwords : include a space

["Martin O'Neal" <martin.oneal@xxxxxxxxxxxx>]

> Here is a simple way to increase password security with 
> respect to dictionary attacks:

> * Passwords must contain at least one space character
> * When the user chooses a new password, tell them they 
> should enter at least two words, separated by a space.

A dictionary-space-dictionary combination is only an order of magnitude
better than a dictionary password alone though.  If your vocabulary is
30,000 words, then when being brute-forced on a contemporary processor,
your dictionary word will be discovered in less than a second, and the
dictionary-space-dictionary password will fall out in less than three
minutes.

In comparison, a non-dictionary 8 character password containing only
upper & lower alpha and numeric's will take 600 days on the same
processor.

Predictable formats and passwords are not happy bed fellows.

Martin...










----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]