Re: [WEB SECURITY] Passwords : include a space

["Ali Soylu" <alisoylu@xxxxxxxxx>]

On Jan 28, 2008 4:40 PM, Paul Schmehl <pauls@xxxxxxxxxxxx> wrote:
> --On Monday, January 28, 2008 12:33:17 -0800 Stephan Wehner
> <stephanwehner@xxxxxxxxx> wrote:
>
> > Here is a simple way to increase password security with respect to
> > dictionary attacks:
> >
> >  * Passwords must contain at least one space character
> >  * When the user chooses a new password, tell them they should enter
> > at least two words, separated by a space.
> >
> > (Example: yellow banana)
> >
> > I would expect this to be easy to understand and users would not have
> > any problems.
> >
>
> The example you give would be cracked in a few minutes using a modern machine
> and a good cracker (e.g. John the Ripper).  It would be far better to use
> Ye11oW B@nAn@.

I'd hope any good password cracker would also try leetizing the
dictionary words and upper/lower combinations, so I would not consider
that password so much better.

ALi

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]