|
Authored by: briand on Tuesday, August 21 2012 @ 06:48 PM EDT |
Also, consider using (or offering to your users if you are an admin),
something
like the "xkcd.com/936"
technique.
I
have made it available as a perl module, Crypt::PW44, which is on the CPAN
network. at this
link
It generates 44-bit passwords using 4 random short words from
the english
language, specifically from the S/KEY dictionary.
It can
be used as a cgi-bin script (to present random passwords for users to
use), or
used in any perl script for creating passwords.
The hard-core folks
might want to use 66-bit passwords, which is what S/Key
generates.
Having a random password is the key, don't use one base
password with
appended guessable text!!!
If you need to store your
passwords, use a strong key for the password file,
and super-strong
passphrase.
briand[ Reply to This | Parent | # ]
|
|
Authored by: Anonymous on Wednesday, August 22 2012 @ 01:14 PM EDT |
Even MD5 is probably good enough. As far as I know, there is still no practical
way of finding a string with a given MD5 hash value. If you believe otherwise,
please prove it to me. The MD5 hash of my password is
2dd2b74b6790710118ed704aa3066760. What is my password?
Obviously, if I were setting up a new system I would choose a stronger hash
function than MD5 or SHA1, but the use of those weaker hash functions in
existing password systems doesn't really create a significant risk. People don't
crack passwords by reversing the hash function; they crack passwords by guessing
them. My password (the one whose hash I gave above) is not easy to guess.[ Reply to This | Parent | # ]
|
|
Authored by: Anonymous on Wednesday, August 22 2012 @ 01:37 PM EDT |
A: Stop putting a max limitation on passwords.
B: Upgrade your
software so special characters can be used.
It's sad to see some sites are
still limiting passwords to "between 8 and 12 characters" and not allowing
special characters to be used.
Better to open the password to be able to
use a pass phrase so a person can easily have a 30 (or more) character phrase
with a nice mix of upper and lower case combined with special
characters.
RAS[ Reply to This | Parent | # ]
|
|
|
|
|