Secure passwords?

Secure passwords?

Secure Home | Search | About
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Secure passwords? AV 11-30-2005
---> Re: Secure passwords? Borked Pseudo M...12-01-2005
---> Re: Secure passwords? Borked Pseudo M...12-01-2005
---> Re: Secure passwords? Thrasher Remail...12-02-2005
`--> Re: Secure passwords? Hairy One Kenob...12-10-2005
Posted by Juergen Nieveler on December 16, 2005, 12:42 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>> I invite you to
>> support your A6 lead glass reference with a comparable cite.
>
> It was /gold/ film (there seems to be an awful lot of selective
> snipping going on)... in any event, after a quick Google - I got it
> wrong. It' *isn't* based on the A6: that's the problem with doing
> things from memory...

Actually the EA-6B did have gold-treated canopies:
http://www.hazegray.org/faq/smn4.htm#D6

Juergen Nieveler
--
Hearing an "Aw, shit" soon after an "on-the-waaay!" means you¢re probably
not getting that promotion.

Posted by Winged on November 30, 2005, 7:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
nemo_outis wrote:
>
> ....
>
>>The nice thing about such passphrases is that they can often be
>>"assembled" in the input window just as I did above, rather than
>>entered directly in final form.
>
> ....
>
>
> A few things I forgot to add:
>
> "Assembling" a passphrase in an password input window can be severely
> hampered if the window is blanked with asterisks. Here's a trick: assemble
> the passphrase in the *user name* window and then cut and paste it to the
> password window (afterwards, go back and fill in the user name).
>
> For the theoretically inclined, the Shannon entropy of ordinary English
> sentences is about 1.2 to 1.4 bits per character. This gives an alternate
> method of calculating passphrase entropy.
>
> Regards,
>
>
>
While I agree with passphrase concept, I prefer tokens (smartcards).

Some systems have limits as to usable PW length. Additionally since the
system should lock after a short period of inactivity to prevent someone
from entering system if a user leaves their terminal, it can be painful
re-entering long passphrases. This does cause complaint. Storing very
long and complex passwords on smartcards with unique passwords stored on
the smartcard for each required system locks out possibility of
dictionary attacks. This is further enhanced if your company servers
lock password with 2 missed attempts (password "should" always be good
but sometimes gurgles occur). This assists in log review if you see bad
password attempts on accounts, as you shouldn't see many on any system.

Meanwhile the user typically has to remember one short pin on their
smartcard to access many systems. Of course the smart card locks with 3
missed pin attempts and inevitably users do lock their cards, but this
is relatively seldom. A 128k card holds an amazing number of
credentials, more than enough for most mortals.

Winged

Posted by nemo_outis on November 30, 2005, 7:59 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> nemo_outis wrote:
>>
>> ....
>>
>>>The nice thing about such passphrases is that they can often be
>>>"assembled" in the input window just as I did above, rather than
>>>entered directly in final form.
>>
>> ....
>>
>>
>> A few things I forgot to add:
>>
>> "Assembling" a passphrase in an password input window can be severely
>> hampered if the window is blanked with asterisks. Here's a trick:
>> assemble the passphrase in the *user name* window and then cut and
>> paste it to the password window (afterwards, go back and fill in the
>> user name).
>>
>> For the theoretically inclined, the Shannon entropy of ordinary
>> English sentences is about 1.2 to 1.4 bits per character. This gives
>> an alternate method of calculating passphrase entropy.
>>
>> Regards,
>>
>>
>>
> While I agree with passphrase concept, I prefer tokens (smartcards).
>
> Some systems have limits as to usable PW length. Additionally since
> the system should lock after a short period of inactivity to prevent
> someone from entering system if a user leaves their terminal, it can
> be painful re-entering long passphrases. This does cause complaint.
> Storing very long and complex passwords on smartcards with unique
> passwords stored on the smartcard for each required system locks out
> possibility of dictionary attacks. This is further enhanced if your
> company servers lock password with 2 missed attempts (password
> "should" always be good but sometimes gurgles occur). This assists in
> log review if you see bad password attempts on accounts, as you
> shouldn't see many on any system.
>
> Meanwhile the user typically has to remember one short pin on their
> smartcard to access many systems. Of course the smart card locks with
> 3 missed pin attempts and inevitably users do lock their cards, but
> this is relatively seldom. A 128k card holds an amazing number of
> credentials, more than enough for most mortals.
>
> Winged



You raise some very valid points. I suppose (depending on particular
circumstances) security should be provided by a judicious blend of what
you know (passwords or passphrases), what you possess (smartcards or
equivalents), and who you are (biometrics).

Regards,


>


Posted by nemo_outis on November 30, 2005, 7:59 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> nemo_outis wrote:
>>
>> ....
>>
>>>The nice thing about such passphrases is that they can often be
>>>"assembled" in the input window just as I did above, rather than
>>>entered directly in final form.
>>
>> ....
>>
>>
>> A few things I forgot to add:
>>
>> "Assembling" a passphrase in an password input window can be severely
>> hampered if the window is blanked with asterisks. Here's a trick:
>> assemble the passphrase in the *user name* window and then cut and
>> paste it to the password window (afterwards, go back and fill in the
>> user name).
>>
>> For the theoretically inclined, the Shannon entropy of ordinary
>> English sentences is about 1.2 to 1.4 bits per character. This gives
>> an alternate method of calculating passphrase entropy.
>>
>> Regards,
>>
>>
>>
> While I agree with passphrase concept, I prefer tokens (smartcards).
>
> Some systems have limits as to usable PW length. Additionally since
> the system should lock after a short period of inactivity to prevent
> someone from entering system if a user leaves their terminal, it can
> be painful re-entering long passphrases. This does cause complaint.
> Storing very long and complex passwords on smartcards with unique
> passwords stored on the smartcard for each required system locks out
> possibility of dictionary attacks. This is further enhanced if your
> company servers lock password with 2 missed attempts (password
> "should" always be good but sometimes gurgles occur). This assists in
> log review if you see bad password attempts on accounts, as you
> shouldn't see many on any system.
>
> Meanwhile the user typically has to remember one short pin on their
> smartcard to access many systems. Of course the smart card locks with
> 3 missed pin attempts and inevitably users do lock their cards, but
> this is relatively seldom. A 128k card holds an amazing number of
> credentials, more than enough for most mortals.
>
> Winged



You raise some very valid points. I suppose (depending on particular
circumstances) security should be provided by a judicious blend of what
you know (passwords or passphrases), what you possess (smartcards or
equivalents), and who you are (biometrics).

Regards,


>


Posted by ToYKillAS on November 30, 2005, 3:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
AV wrote:
> Which of these two passwords should be the most secure one:
>
> 1. "Jag undrar vaad som aar ett sakert"
>
> 2. "XVg6Gtzw"
>
> The first one is far more easy to understand for me since it is a
> somewhat incorrectly spelled sentence (in Swedish) whereas the other is
> 8 very cryptic characters not easy to remember.
>
> To me it the first one seems much more secure since it has so many more
> characters and therefore should take far longer to bruce force than the
> other. Dictionary attacks should also be rather useless since the words
> are incorrectly spelled and also it is a sentence and not a word. The
> sentence with similar mispellings would in English be something like:
>
> "I wooonder what iss a secuure"
>
> So what are you opinions?

http://www.google.be/search?hl=fr&q=what+is+secure+password&meta=
maybe ???

--
#############################################################
# http://users.teledisnet.be/web/ari01350/ToYKillAS.jpg #
# -=- Der Säger von St. Georg -=- #
#############################################################

Similar ThreadsPosted
Advice needed on secure remote datacenter and secure communication August 24, 2008, 8:36 pm
Secure Auditor secure your windows April 28, 2008, 6:24 am
Passwords February 6, 2006, 2:04 am
Boot Passwords December 21, 2005, 7:35 am
Hashes and Passwords May 21, 2006, 5:36 am
Bios Passwords September 29, 2006, 5:35 pm
virtue of salted passwords November 21, 2005, 12:28 am
Image files as passwords February 22, 2007, 6:33 am
Legality of decrypting passwords June 30, 2008, 8:48 am
solutions for storing passwords on a computer November 4, 2005, 9:03 am

The site map in XML format XML site map

Contact Us | Privacy Policy