Password Strength

[Martin Wessendorf-2]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Dear List--

I can't say I've ever sent a link for a webcomic to the confocal list,
but here goes.

http://xkcd.com/936/

(As far as I know, clicking on this link will not infect your computer
with a virus or take you to a porn site.)

Anybody able to verify or disprove this?  Intuitively, it makes sense,
but so do a lot of things that are wrong.

Martin
--
Martin Wessendorf, Ph.D.                   office: [phone]
Assoc Prof, Dept Neuroscience                 lab: [phone]
University of Minnesota             Preferred FAX: [phone]
6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
Minneapolis, MN  55455                    e-mail: [hidden email]

[Pedro Almada]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Dear Martin,

I'd venture a guess it's not. Modern hackers use word lists to guess an
account's password, which are generated automatically from dictionaries.
These may be generated as to include common character substitutions easily,
as well as combinations of words. As such, the probability of guessing the
password is actually a function of the dictionary that the hackers use, how
rare the word(s) is(are) as well as the length of the password. This will,
by definition, be a higher probability than just having a completely random
set of characters of the same length.
Comparing both word examples, maybe the combination of words does have an
advantage, in that the hacker would need to have generated a longer list
with that particular combination. Still, the probability of your password
being found is only a function of its length if it isn't on the hackers
list. Hackers have such comprehensive lists that the only safe password is
complete random gibberish.

That's my guess anyway. As a sidenote, good choice of webcomic!

Best,
Pedro Almada
On Aug 10, 2011 8:30 PM, "Martin Wessendorf" <[hidden email]> wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the confocal list,
> but here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect your computer
> with a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this? Intuitively, it makes sense,
> but so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D. office: [phone]
> Assoc Prof, Dept Neuroscience lab: [phone]
> University of Minnesota Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE Dept Fax: [phone]
> Minneapolis, MN 55455 e-mail: [hidden email]

[Guy Cox-2]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Martin,

            It's probably right, but 1000 guesses per second would require a connection speed way beyond even what I get on campus to another on-campus computer.  Even 100 per second (one month) seems implausible.  At 10 guesses per second you're looking at 2½ years ... And any system that will allow you 268,435,456 attempts at logging in before it freezes you out is terminally insecure!  (MS exchange allows 5 tries).

                The four random words thing is fine provided that (a) only very few do it and (b) the words truly are random.  But if it catches on then all a cracking algorithm has to do is try every combination of dictionary words that add up to the password length, a vastly simpler task.

                                        Guy


Optical Imaging Techniques in Cell Biology
by Guy Cox    CRC Press / Taylor & Francis
     http://www.guycox.com/optical.htm
______________________________________________
Associate Professor Guy Cox, MA, DPhil(Oxon)
Australian Centre for Microscopy & Microanalysis,
Madsen Building F09, University of Sydney, NSW 2006

Phone [phone]     Fax [phone]
             Mobile [phone]
______________________________________________
      http://www.guycox.net
 


-----Original Message-----
From: Confocal Microscopy List [mailto:[hidden email]] On Behalf Of Martin Wessendorf
Sent: Thursday, 11 August 2011 5:31 AM
To: [hidden email]
Subject: Password Strength

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Dear List--

I can't say I've ever sent a link for a webcomic to the confocal list,
but here goes.

http://xkcd.com/936/

(As far as I know, clicking on this link will not infect your computer
with a virus or take you to a porn site.)

Anybody able to verify or disprove this?  Intuitively, it makes sense,
but so do a lot of things that are wrong.

Martin
--
Martin Wessendorf, Ph.D.                   office: [phone]
Assoc Prof, Dept Neuroscience                 lab: [phone]
University of Minnesota             Preferred FAX: [phone]
6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
Minneapolis, MN  55455                    e-mail: [hidden email]

-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1391 / Virus Database: 1520/3824 - Release Date: 08/09/11

[Stephen C. Kempf]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

One thing I've always wondered is why systems can't be set-up so they won't accept more than one password attempt on a given account every 1 sec, 5 sec or whatever. I suppose this might be a problem if large numbers of people had to access the same account, but other than that I would think this would greatly reduce the number of successful hacks. Of course, maybe I'm missing something, if so, enlighten me. (-;{

Steve

On Aug 10, 2011, at 3:12 PM, Guy Cox wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Martin,
>
>            It's probably right, but 1000 guesses per second would require a connection speed way beyond even what I get on campus to another on-campus computer.  Even 100 per second (one month) seems implausible.  At 10 guesses per second you're looking at 2½ years ... And any system that will allow you 268,435,456 attempts at logging in before it freezes you out is terminally insecure!  (MS exchange allows 5 tries).
>
> The four random words thing is fine provided that (a) only very few do it and (b) the words truly are random.  But if it catches on then all a cracking algorithm has to do is try every combination of dictionary words that add up to the password length, a vastly simpler task.
>
>                                        Guy
>
>
> Optical Imaging Techniques in Cell Biology
> by Guy Cox    CRC Press / Taylor & Francis
>     http://www.guycox.com/optical.htm
> ______________________________________________
> Associate Professor Guy Cox, MA, DPhil(Oxon)
> Australian Centre for Microscopy & Microanalysis,
> Madsen Building F09, University of Sydney, NSW 2006
>
> Phone [phone]     Fax [phone]
>             Mobile [phone]
> ______________________________________________
>      http://www.guycox.net
>
>
>
> -----Original Message-----
> From: Confocal Microscopy List [mailto:[hidden email]] On Behalf Of Martin Wessendorf
> Sent: Thursday, 11 August 2011 5:31 AM
> To: [hidden email]
> Subject: Password Strength
>
> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the confocal list,
> but here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect your computer
> with a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this?  Intuitively, it makes sense,
> but so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1391 / Virus Database: 1520/3824 - Release Date: 08/09/11

[Pedro Almada]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Guy,

The connection speed isn't an issue with a modern hacker. Most will use
"farms" of hacked computers. Those worms your antivirus likes to delete are
usually attempts at gaining use of your machine and internet connection to
be used for attacks like this. So, one machine can't do it, but several
thousand on the internet can. Also, dictionary attacks require a reduced
number of attempts, by several orders of magnitude.
You make a good point of how the server should also throttle or block
connections after x attempts, but you'd be amazed at how many small website
administrators don't actually do that. As an example, twitter was a victim
of such a dictionary attack:
http://www.codinghorror.com/blog/2009/01/dictionary-attacks-101.html

Consider how many websites require a unique login and how many users have
the same password across several websites, you can guess that a small
website which was successfuly hacked will reveal the credentials for other,
more important websites. And hackers do keep lists of successful logins
which they sell and trade between each other...

Best,
Pedro


On 10 August 2011 21:12, Guy Cox <[hidden email]> wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Martin,
>
>            It's probably right, but 1000 guesses per second would require a
> connection speed way beyond even what I get on campus to another on-campus
> computer.  Even 100 per second (one month) seems implausible.  At 10 guesses
> per second you're looking at 2½ years ... And any system that will allow you
> 268,435,456 attempts at logging in before it freezes you out is terminally
> insecure!  (MS exchange allows 5 tries).
>
>                The four random words thing is fine provided that (a) only
> very few do it and (b) the words truly are random.  But if it catches on
> then all a cracking algorithm has to do is try every combination of
> dictionary words that add up to the password length, a vastly simpler task.
>
>                                        Guy
>
>
> Optical Imaging Techniques in Cell Biology
> by Guy Cox    CRC Press / Taylor & Francis
>     http://www.guycox.com/optical.htm
> ______________________________________________
> Associate Professor Guy Cox, MA, DPhil(Oxon)
> Australian Centre for Microscopy & Microanalysis,
> Madsen Building F09, University of Sydney, NSW 2006
>
> Phone [phone]     Fax [phone]
>             Mobile [phone]
> ______________________________________________
>      http://www.guycox.net
>
>
>
> -----Original Message-----
> From: Confocal Microscopy List [mailto:[hidden email]]
> On Behalf Of Martin Wessendorf
> Sent: Thursday, 11 August 2011 5:31 AM
> To: [hidden email]
> Subject: Password Strength
>
> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the confocal list,
> but here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect your computer
> with a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this?  Intuitively, it makes sense,
> but so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1391 / Virus Database: 1520/3824 - Release Date: 08/09/11
>

[Guy Cox-2]

This is all very true, and I made the point about dictionary attacks myself.  But I'd have thought it would be far more profitable, if you are infecting a computer, to put in a keystroke logger.  That way you stand quite a good chance of getting into bank accounts ....

                                        Guy

Optical Imaging Techniques in Cell Biology
by Guy Cox    CRC Press / Taylor & Francis
     http://www.guycox.com/optical.htm
______________________________________________
Associate Professor Guy Cox, MA, DPhil(Oxon)
Australian Centre for Microscopy & Microanalysis,
Madsen Building F09, University of Sydney, NSW 2006

Phone [phone]     Fax [phone]
             Mobile [phone]
______________________________________________
      http://www.guycox.net
 


-----Original Message-----
From: Confocal Microscopy List [mailto:[hidden email]] On Behalf Of Pedro Almada
Sent: Thursday, 11 August 2011 6:52 AM
To: [hidden email]
Subject: Re: Password Strength

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Guy,

The connection speed isn't an issue with a modern hacker. Most will use
"farms" of hacked computers. Those worms your antivirus likes to delete are
usually attempts at gaining use of your machine and internet connection to
be used for attacks like this. So, one machine can't do it, but several
thousand on the internet can. Also, dictionary attacks require a reduced
number of attempts, by several orders of magnitude.
You make a good point of how the server should also throttle or block
connections after x attempts, but you'd be amazed at how many small website
administrators don't actually do that. As an example, twitter was a victim
of such a dictionary attack:
http://www.codinghorror.com/blog/2009/01/dictionary-attacks-101.html

Consider how many websites require a unique login and how many users have
the same password across several websites, you can guess that a small
website which was successfuly hacked will reveal the credentials for other,
more important websites. And hackers do keep lists of successful logins
which they sell and trade between each other...

Best,
Pedro


On 10 August 2011 21:12, Guy Cox <[hidden email]> wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Martin,
>
>            It's probably right, but 1000 guesses per second would require a
> connection speed way beyond even what I get on campus to another on-campus
> computer.  Even 100 per second (one month) seems implausible.  At 10 guesses
> per second you're looking at 2½ years ... And any system that will allow you
> 268,435,456 attempts at logging in before it freezes you out is terminally
> insecure!  (MS exchange allows 5 tries).
>
>                The four random words thing is fine provided that (a) only
> very few do it and (b) the words truly are random.  But if it catches on
> then all a cracking algorithm has to do is try every combination of
> dictionary words that add up to the password length, a vastly simpler task.
>
>                                        Guy
>
>
> Optical Imaging Techniques in Cell Biology
> by Guy Cox    CRC Press / Taylor & Francis
>     http://www.guycox.com/optical.htm
> ______________________________________________
> Associate Professor Guy Cox, MA, DPhil(Oxon)
> Australian Centre for Microscopy & Microanalysis,
> Madsen Building F09, University of Sydney, NSW 2006
>
> Phone [phone]     Fax [phone]
>             Mobile [phone]
> ______________________________________________
>      http://www.guycox.net
>
>
>
> -----Original Message-----
> From: Confocal Microscopy List [mailto:[hidden email]]
> On Behalf Of Martin Wessendorf
> Sent: Thursday, 11 August 2011 5:31 AM
> To: [hidden email]
> Subject: Password Strength
>
> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the confocal list,
> but here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect your computer
> with a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this?  Intuitively, it makes sense,
> but so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1391 / Virus Database: 1520/3824 - Release Date: 08/09/11
>

-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1391 / Virus Database: 1520/3824 - Release Date: 08/09/11

[David Baddeley]

Speed wise 1000 attempts/
*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Cool comic, and can't resist commenting ...

Speed wise 1000 attempts/sec is easily doable if (and only if - which is relatively uncommon) the site doesn't have a delay after a failed attempt (or certain number of failed attempts). The request size is only likely to be a couple of 100 bytes whereas your you'll easily be getting 10s of Mbit/s to overseas internet sites these days. Remember that there's nothing to to stop you sending the next request before the first one has returned.

Whilst the words should be random wrt each other, there is no requirement that the method is uncommon. His 11 bits per word reflects the number of words in the dictionary rather than the the information in each word (~56 bits). It thus already describes the methods strength against exactly the attack you propose. If you did somehow know the exact length of the password in advance you would probably loose another 4-5 bits, but this is unlikely.

David


--- On Thu, 11/8/11, Guy Cox <[hidden email]> wrote:

> From: Guy Cox <[hidden email]>
> Subject: Re: Password Strength
> To: [hidden email]
> Received: Thursday, 11 August, 2011, 8:12 AM
> *****
> To join, leave or search the confocal microscopy listserv,
> go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Martin,
>
>             It's probably
> right, but 1000 guesses per second would require a
> connection speed way beyond even what I get on campus to
> another on-campus computer.  Even 100 per second (one
> month) seems implausible.  At 10 guesses per second
> you're looking at 2½ years ... And any system that will
> allow you 268,435,456 attempts at logging in before it
> freezes you out is terminally insecure!  (MS exchange
> allows 5 tries).
>
>         The four random words
> thing is fine provided that (a) only very few do it and (b)
> the words truly are random.  But if it catches on then
> all a cracking algorithm has to do is try every combination
> of dictionary words that add up to the password length, a
> vastly simpler task.
>
>                
>                
>         Guy
>
>
> Optical Imaging Techniques in Cell Biology
> by Guy Cox    CRC Press / Taylor & Francis
>      http://www.guycox.com/optical.htm
> ______________________________________________
> Associate Professor Guy Cox, MA, DPhil(Oxon)
> Australian Centre for Microscopy & Microanalysis,
> Madsen Building F09, University of Sydney, NSW 2006
>
> Phone [phone]     Fax +61 2
> 9351 7682
>              Mobile
> 0413 281 861
> ______________________________________________
>       http://www.guycox.net
>  
>
>
> -----Original Message-----
> From: Confocal Microscopy List [mailto:[hidden email]]
> On Behalf Of Martin Wessendorf
> Sent: Thursday, 11 August 2011 5:31 AM
> To: [hidden email]
> Subject: Password Strength
>
> *****
> To join, leave or search the confocal microscopy listserv,
> go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the
> confocal list,
> but here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect
> your computer
> with a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this?  Intuitively,
> it makes sense,
> but so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D.         
>          office: (612)
> 626-0145
> Assoc Prof, Dept Neuroscience       
>          lab: [phone]
> University of Minnesota         
>    Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept
> Fax: [phone]
> Minneapolis, MN  55455       
>             e-mail: [hidden email]
>
> -----
> No virus found in this message.
> Checked by AVG - www.avg.com
> Version: 10.0.1391 / Virus Database: 1520/3824 - Release
> Date: 08/09/11
>

[Tao Tong]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

But "correct horse battery staple" are composed of all common dictionary
words, and it is not immune to dictionary attack. co01ho02ba03st04 is a
little better.

Better still, from a phrase like this:

Go ahead, make my day.

you get gammd from the first letters from each word, then throw in some
variations, such as gAmmD0809

Shoud be much better, easy to remember, hard to crack.



On Wed, Aug 10, 2011 at 3:30 PM, Martin Wessendorf <[hidden email]> wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/**wa?A0=confocalmicroscopy<http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy>
> *****
>
> Dear List--
>
> I can't say I've ever sent a link for a webcomic to the confocal list, but
> here goes.
>
> http://xkcd.com/936/
>
> (As far as I know, clicking on this link will not infect your computer with
> a virus or take you to a porn site.)
>
> Anybody able to verify or disprove this?  Intuitively, it makes sense, but
> so do a lot of things that are wrong.
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]
>

--
Tao Tong
Bio-Imaging Resource Center
Rockefeller University
Box 209/Bronk 202
1230 York Avenue, New York, NY 10065
Tel: [phone]

[Martin Wessendorf-2]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

On 8/11/2011 11:29 AM, Tao Tong wrote:

> But "correct horse battery staple" are composed of all common dictionary
> words, and it is not immune to dictionary attack. co01ho02ba03st04 is a
> little better.
>
> Better still, from a phrase like this:
>
> Go ahead, make my day.
>
> you get gammd from the first letters from each word, then throw in some
> variations, such as gAmmD0809
>
> Shoud be much better, easy to remember, hard to crack.

If we consider a 9 character password and assume that the characters can
be one of 128 ASCII characters, we get a total of (128)^9 possible
combinations, or 9.2 x 10^18.

If we assume that English contains 50,000 "common" words that a
dictionary would need to contain (--I think that would be a conservative
estimate, since English has a total vocabulary of about 250,000 words
and capitalizations, proper names, etc would all need to be considered)
and limit our password to 4 words, we would get 6.3 x 10^18--i.e. almost
the same.

My sense is that the "four-words" strategy would probably work, as long
as the resulting password were reasonably long and word order were truly
random (i.e., not "big dog bit me").

 From what others have observed, it sounds as if the real place tackle
password security is on the server: to limit logon attempts to one every
5 seconds or so--short enough not to drive users nuts but long enough to
hamper brute-force attacks.

Martin
--
Martin Wessendorf, Ph.D.                   office: [phone]
Assoc Prof, Dept Neuroscience                 lab: [phone]
University of Minnesota             Preferred FAX: [phone]
6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
Minneapolis, MN  55455                    e-mail: [hidden email]

[Craig Brideau]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Wouldn't most of this depend on the type of attack a hacker attempts?  If
they try a dictionary attack they will only discover passwords that feature
dictionary words or modified versions of words. (i.e. p455word)  But what if
the hacker instead tries a true 'brute force' attack and just throws random
characters at it?  Then isn't longer better, regardless of whether words are
used or just random characters...?

Craig


On Thu, Aug 11, 2011 at 11:40 AM, Martin Wessendorf <[hidden email]> wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/**wa?A0=confocalmicroscopy<http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy>
> *****
>
> On 8/11/2011 11:29 AM, Tao Tong wrote:
>
>  But "correct horse battery staple" are composed of all common dictionary
>> words, and it is not immune to dictionary attack. co01ho02ba03st04 is a
>> little better.
>>
>> Better still, from a phrase like this:
>>
>> Go ahead, make my day.
>>
>> you get gammd from the first letters from each word, then throw in some
>> variations, such as gAmmD0809
>>
>> Shoud be much better, easy to remember, hard to crack.
>>
>
> If we consider a 9 character password and assume that the characters can be
> one of 128 ASCII characters, we get a total of (128)^9 possible
> combinations, or 9.2 x 10^18.
>
> If we assume that English contains 50,000 "common" words that a dictionary
> would need to contain (--I think that would be a conservative estimate,
> since English has a total vocabulary of about 250,000 words and
> capitalizations, proper names, etc would all need to be considered) and
> limit our password to 4 words, we would get 6.3 x 10^18--i.e. almost the
> same.
>
> My sense is that the "four-words" strategy would probably work, as long as
> the resulting password were reasonably long and word order were truly random
> (i.e., not "big dog bit me").
>
> From what others have observed, it sounds as if the real place tackle
> password security is on the server: to limit logon attempts to one every 5
> seconds or so--short enough not to drive users nuts but long enough to
> hamper brute-force attacks.
>
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]
>

[Stephen C. Kempf]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

I did think of a downside to my suggestion of limiting log on attempts to one every second, 5 sec or whatever. If the the hacker did try a brute force attack, I suspect it would tie-up the server for as long as it went on. This would mean no one could get on as long as the hack continued. Of course, possibly the hack attack could recognize the inefficiency of continuing with logons limited say to every 5 sec and would move onto more fertile ground.

Steve

On Aug 11, 2011, at 12:40 PM, Martin Wessendorf wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> On 8/11/2011 11:29 AM, Tao Tong wrote:
>
>> But "correct horse battery staple" are composed of all common dictionary
>> words, and it is not immune to dictionary attack. co01ho02ba03st04 is a
>> little better.
>>
>> Better still, from a phrase like this:
>>
>> Go ahead, make my day.
>>
>> you get gammd from the first letters from each word, then throw in some
>> variations, such as gAmmD0809
>>
>> Shoud be much better, easy to remember, hard to crack.
>
> If we consider a 9 character password and assume that the characters can be one of 128 ASCII characters, we get a total of (128)^9 possible combinations, or 9.2 x 10^18.
>
> If we assume that English contains 50,000 "common" words that a dictionary would need to contain (--I think that would be a conservative estimate, since English has a total vocabulary of about 250,000 words and capitalizations, proper names, etc would all need to be considered) and limit our password to 4 words, we would get 6.3 x 10^18--i.e. almost the same.
>
> My sense is that the "four-words" strategy would probably work, as long as the resulting password were reasonably long and word order were truly random (i.e., not "big dog bit me").
>
> From what others have observed, it sounds as if the real place tackle password security is on the server: to limit logon attempts to one every 5 seconds or so--short enough not to drive users nuts but long enough to hamper brute-force attacks.
>
> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone]
> Assoc Prof, Dept Neuroscience                 lab: [phone]
> University of Minnesota             Preferred FAX: [phone]
> 6-145 Jackson Hall, 321 Church St. SE    Dept Fax: [phone]
> Minneapolis, MN  55455                    e-mail: [hidden email]

[Mario Emmenlauer]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

> On 8/11/2011 11:29 AM, Tao Tong wrote:
>> But "correct horse battery staple" are composed of all common
dictionary
>> words, and it is not immune to dictionary attack. co01ho02ba03st04 is a
little better.
>> Better still, from a phrase like this:
>> Go ahead, make my day.
>> you get gammd from the first letters from each word, then throw in some
variations, such as gAmmD0809
>> Shoud be much better, easy to remember, hard to crack.
> If we consider a 9 character password and assume that the characters can
be one of 128 ASCII characters, we get a total of (128)^9 possible
combinations, or 9.2 x 10^18.
> If we assume that English contains 50,000 "common" words that a
> dictionary would need to contain (--I think that would be a conservative
estimate, since English has a total vocabulary of about 250,000 words
and capitalizations, proper names, etc would all need to be considered)
and limit our password to 4 words, we would get 6.3 x 10^18--i.e. almost
the same.
> My sense is that the "four-words" strategy would probably work, as long
as the resulting password were reasonably long and word order were truly
random (i.e., not "big dog bit me").

I quickly computed the same numbers, and even with a conservative guess
of 10,000 "common" words its (currently) impossible to break such a
multi-word password. :-)


>  From what others have observed, it sounds as if the real place tackle
> password security is on the server: to limit logon attempts to one every
5 seconds or so--short enough not to drive users nuts but long enough to
hamper brute-force attacks.

I don't think this is the typical problem. Many server software already
limits login attempts (i.e. check the ssh MaxStartups config parameter).
If the software itself doesn't do it, there are firewalls and other
traffic monitoring packages that can do the same thing (denyhosts,
fail2ban,
http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/).

But I think the password attack discussed in the xkcd assumes that the
attacker is already in possession of the encrypted password. A remote
attack with 1000 guesses / sec on any reasonable web-service is not very
realistic. I.e. for a website, a small error message from the server
might be 1k in size, leading to 1MB/sec traffic for the attack. Its
unlikely that 1MB/sec login attempts go unnoticed, unless the Admin has
no monitoring whatsoever.

I assume that the xkcd is rather concerned about when hackers steal
encrypted passwords from 30,000,000 playstation network customers, and
those (hopefully encrypted) passwords have not been salted
(http://en.wikipedia.org/wiki/Salt_%28cryptography%29) :-)

Just my two cents,

    Mario


> Martin
> --
> Martin Wessendorf, Ph.D.                   office: [phone] Assoc
Prof, Dept Neuroscience                 lab: [phone] University
of Minnesota             Preferred FAX: [phone] Jackson
Hall, 321 Church St. SE    Dept Fax: [phone] Minneapolis, MN
55455                    e-mail: [hidden email]

[Andrea Latini-4]

CONTENTS DELETED

The author has deleted this message.

[Alberto Diaspro]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

I am personally against any password…hopefully in the future we will remove all of them


On Aug 12, 2011, at 2:02 PM, Latini wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> I will be out of the office until the 23rd of August. I will be checking my emails periodically but I apologies for any delay in response that may be caused.
>
> For any urgent enquiries, please contact me on my mobile [phone]
>
> Andrea Latini
> Crisel Instruments Srl, CrEST Srl

[Torsten.Fregin]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Hi,

I think with a modern Campus network we should not worry much about a  
brute force attack from abroad. Most problems occur b/c users with  
admin accounts just click on email attachments or visit obscure  
internet webpages.

Some time ago I was truly astonished when I saw a demonstration how  
easy it is to break into a desktop PC running Windows OS when you have  
real access to it and are able to boot from CD/DVD. In the web comic  
this is also mentioned ("hash") - just read this page:

http://en.wikipedia.org/wiki/Rainbow_table

and maybe you want to try it yourself - just take a look onto the  
external links mentioned in the wikipedia article. In Windows, your  
password is divided into parts of 7 digits, and if you e.g. use 14  
digits and only 0-9 and a-z/A-Z it takes about 1 minute to get your  
password (depending on how fast your PC is booting and if your  
installation is not secured against reading the files)...

What I do to be "save":

I use other characters which are not used by the English language and  
in the simple rainbow table versions.

The bios of my PC is password protected - so you cannot boot without  
the password. The case is locked, too. And booting from CD/DVD/USB is  
disabled in the bios. And I don't use an admin account (only when I  
need to install software). I was thinking to use a virtual  
environment, but so far I just tried it and did not switch yet.

Have fun!
:-) Torsten

[rjpalmer]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Help Mr. Moderator!
I must have subscribed to the wrong list!  I thought this list had  
something to do with microscopy, but apparently it is populated with  
computer geeks and game theorists who fancy themselves to be cyber-
security experts.  All I can say is that the pay is MUCH better in  
that sector.  Maybe a change of career (or list) is warranted?

On Aug 12, 2011, at 7:39 AM, Mario Emmenlauer wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
>> On 8/11/2011 11:29 AM, Tao Tong wrote:
>>> But "correct horse battery staple" are composed of all common
> dictionary
>>> words, and it is not immune to dictionary attack. co01ho02ba03st04  
>>> is a
> little better.
>>> Better still, from a phrase like this:
>>> Go ahead, make my day.
>>> you get gammd from the first letters from each word, then throw in  
>>> some
> variations, such as gAmmD0809
>>> Shoud be much better, easy to remember, hard to crack.
>> If we consider a 9 character password and assume that the  
>> characters can
> be one of 128 ASCII characters, we get a total of (128)^9 possible
> combinations, or 9.2 x 10^18.
>> If we assume that English contains 50,000 "common" words that a
>> dictionary would need to contain (--I think that would be a  
>> conservative
> estimate, since English has a total vocabulary of about 250,000 words
> and capitalizations, proper names, etc would all need to be  
> considered)
> and limit our password to 4 words, we would get 6.3 x 10^18--i.e.  
> almost
> the same.
>> My sense is that the "four-words" strategy would probably work, as  
>> long
> as the resulting password were reasonably long and word order were  
> truly
> random (i.e., not "big dog bit me").
>
> I quickly computed the same numbers, and even with a conservative  
> guess
> of 10,000 "common" words its (currently) impossible to break such a
> multi-word password. :-)
>
>
>> From what others have observed, it sounds as if the real place tackle
>> password security is on the server: to limit logon attempts to one  
>> every
> 5 seconds or so--short enough not to drive users nuts but long  
> enough to
> hamper brute-force attacks.
>
> I don't think this is the typical problem. Many server software  
> already
> limits login attempts (i.e. check the ssh MaxStartups config  
> parameter).
> If the software itself doesn't do it, there are firewalls and other
> traffic monitoring packages that can do the same thing (denyhosts,
> fail2ban,
> http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/)
> .
>
> But I think the password attack discussed in the xkcd assumes that the
> attacker is already in possession of the encrypted password. A remote
> attack with 1000 guesses / sec on any reasonable web-service is not  
> very
> realistic. I.e. for a website, a small error message from the server
> might be 1k in size, leading to 1MB/sec traffic for the attack. Its
> unlikely that 1MB/sec login attempts go unnoticed, unless the Admin  
> has
> no monitoring whatsoever.
>
> I assume that the xkcd is rather concerned about when hackers steal
> encrypted passwords from 30,000,000 playstation network customers, and
> those (hopefully encrypted) passwords have not been salted
> (http://en.wikipedia.org/wiki/Salt_%28cryptography%29) :-)
>
> Just my two cents,
>
>    Mario
>
>
>> Martin
>> --
>> Martin Wessendorf, Ph.D.                   office: [phone]  
>> Assoc
> Prof, Dept Neuroscience                 lab: [phone] University
> of Minnesota             Preferred FAX: [phone] Jackson
> Hall, 321 Church St. SE    Dept Fax: [phone] Minneapolis, MN
> 55455                    e-mail: [hidden email]

Robert J. Palmer Jr., Ph.D.
Natl Inst Dental Craniofacial Res - Natl Insts Health
Oral Infection and Immunity Branch
Bldg 30, Room 310
30 Convent Drive
Bethesda MD 20892
ph 301-594-0025
fax [phone]

[Torsten.Fregin]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

> Help Mr. Moderator!
> I must have subscribed to the wrong list!  I thought this list had  
> something to do with microscopy, but apparently it is populated with  
> computer geeks and game theorists who fancy themselves to be  
> cyber-security experts.  All I can say is that the pay is MUCH  
> better in that sector.  Maybe a change of career (or list) is  
> warranted?

Sometimes it is very helpful to know a bit about this kind of stuff.  
E.g. some time ago we had the problem that nobody remembered the admin  
password for one of our confocal microscope computers...

[Scott, Mark]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Help Mr. IT Person,

We use a COMPUTER to view our imaging results and can no longer gain access to it due to forgetting passwords of insane complexity and length or have been hacked because someone made the admin password "Admin1234".  

Advice please...



-----Original Message-----
From: Confocal Microscopy List [mailto:[hidden email]] On Behalf Of rjpalmer
Sent: 12 August 2011 13:40
To: [hidden email]
Subject: Re: Password Strength

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

Help Mr. Moderator!
I must have subscribed to the wrong list!  I thought this list had  
something to do with microscopy, but apparently it is populated with  
computer geeks and game theorists who fancy themselves to be cyber-
security experts.  All I can say is that the pay is MUCH better in  
that sector.  Maybe a change of career (or list) is warranted?

[rjpalmer]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

I'm not an IT person, nor do I play one on TV or lists, but here's a  
genuine solution, but not acceptable for folks who feel all computers  
HAVE to be connected to everyplace in the universe.

Take the computer off the network.  Require your users to transfer  
data using removable drives.  Whiners can find another machine.  Still  
have problems with crap on your machine?  Water-board your users until  
someone 'fesses up.

That's what I do.  It's worked fine, and since the time of floppy  
disks.  Haven't had to water-board anyone yet.

On Aug 12, 2011, at 9:22 AM, Scott, Mark wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Help Mr. IT Person,
>
> We use a COMPUTER to view our imaging results and can no longer gain  
> access to it due to forgetting passwords of insane complexity and  
> length or have been hacked because someone made the admin password  
> "Admin1234".
>
> Advice please...
>
>
>
> -----Original Message-----
> From: Confocal Microscopy List [mailto:[hidden email]
> ] On Behalf Of rjpalmer
> Sent: 12 August 2011 13:40
> To: [hidden email]
> Subject: Re: Password Strength
>
> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
> *****
>
> Help Mr. Moderator!
> I must have subscribed to the wrong list!  I thought this list had
> something to do with microscopy, but apparently it is populated with
> computer geeks and game theorists who fancy themselves to be cyber-
> security experts.  All I can say is that the pay is MUCH better in
> that sector.  Maybe a change of career (or list) is warranted?

Robert J. Palmer Jr., Ph.D.
Natl Inst Dental Craniofacial Res - Natl Insts Health
Oral Infection and Immunity Branch
Bldg 30, Room 310
30 Convent Drive
Bethesda MD 20892
ph 301-594-0025
fax [phone]

[Tao Tong]

*****
To join, leave or search the confocal microscopy listserv, go to:
http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy
*****

I think Robert Hooke's solution is more elegant: use paper and pen, draw
whatever you saw under the microscope. After all, his Micrographia is very
beautiful, a genuine classic.

Drawing used to be a required skill for biologists. The good old days.

:-)

On Fri, Aug 12, 2011 at 9:44 AM, rjpalmer <[hidden email]>wrote:

> *****
> To join, leave or search the confocal microscopy listserv, go to:
> http://lists.umn.edu/cgi-bin/**wa?A0=confocalmicroscopy<http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy>
> *****
>
> I'm not an IT person, nor do I play one on TV or lists, but here's a
> genuine solution, but not acceptable for folks who feel all computers HAVE
> to be connected to everyplace in the universe.
>
> Take the computer off the network.  Require your users to transfer data
> using removable drives.  Whiners can find another machine.  Still have
> problems with crap on your machine?  Water-board your users until someone
> 'fesses up.
>
> That's what I do.  It's worked fine, and since the time of floppy disks.
>  Haven't had to water-board anyone yet.
>
>
> On Aug 12, 2011, at 9:22 AM, Scott, Mark wrote:
>
>  *****
>> To join, leave or search the confocal microscopy listserv, go to:
>> http://lists.umn.edu/cgi-bin/**wa?A0=confocalmicroscopy<http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy>
>> *****
>>
>> Help Mr. IT Person,
>>
>> We use a COMPUTER to view our imaging results and can no longer gain
>> access to it due to forgetting passwords of insane complexity and length or
>> have been hacked because someone made the admin password "Admin1234".
>>
>> Advice please...
>>
>>
>>
>> -----Original Message-----
>> From: Confocal Microscopy List [mailto:CONFOCALMICROSCOPY@**LISTS.UMN.EDU<[hidden email]>]
>> On Behalf Of rjpalmer
>> Sent: 12 August 2011 13:40
>> To: [hidden email].**EDU <[hidden email]>
>> Subject: Re: Password Strength
>>
>> *****
>> To join, leave or search the confocal microscopy listserv, go to:
>> http://lists.umn.edu/cgi-bin/**wa?A0=confocalmicroscopy<http://lists.umn.edu/cgi-bin/wa?A0=confocalmicroscopy>
>> *****
>>
>> Help Mr. Moderator!
>> I must have subscribed to the wrong list!  I thought this list had
>> something to do with microscopy, but apparently it is populated with
>> computer geeks and game theorists who fancy themselves to be cyber-
>> security experts.  All I can say is that the pay is MUCH better in
>> that sector.  Maybe a change of career (or list) is warranted?
>>
>
> Robert J. Palmer Jr., Ph.D.
> Natl Inst Dental Craniofacial Res - Natl Insts  Health
> Oral Infection and Immunity Branch
> Bldg 30, Room 310
> 30 Convent Drive
> Bethesda MD 20892
> ph 301-594-0025
> fax [phone]
>

--
Tao Tong
Bio-Imaging Resource Center
Rockefeller University
Box 209/Bronk 202
1230 York Avenue, New York, NY 10065
Tel: [phone]