Re: [PLUG] Does restricting partial words weaken passwords?

[gabriel rosenkoetter <gr@eclipsed.net>]

On Thu, Nov 29, 2001 at 03:28:17PM -0500, Darxus@chaosreigns.com wrote:
> At the picnic it was suggested that disallowing passwords which contained
> dictionary words would reduce the strength of the password, by reducing the
> number of possible passwords.  The question was, how effective would a
> reverse dictionary attack be ?

That's an interesting theory. I don't agree with the math that was
in Dave's post, though. Did it include numerals? Shifted numerals?
Count upper- and lower-case letters as the same or different? What
about control characters, some of which are A-OK in a password, and
which I frequently use? To do this right, you really have to base your
search space not on natural language but on ASCII codes, removing
the ones that are not useable, like ^M, ^J, ^C, ^[, ^H, ^V, and
anything it's not possible to issue with a keystroke (0x00 through
0x06, if memory serves), but including everything you can get with
the meta-key and so forth (that is, everything upwards of 0x7F; note
that that more than doubles your character search space). Yes, I
really do use these characters in passwords and -phrases. Routinely.

I would point out that the password that you are "limited" to by
this take significantly longer to brute force than ones that you can
reach with a dictionary attack.

I'd also like to reiterate that if anyone ever gets their hands on
your encrypted password file, you might as well consider yourself
already screwed and throw in the towel. The point of strong passwords
is so that random typing (al Swordfish) doesn't get anybody anywhere.
And picking a password like that from the search space "limited"
by removing words (or word-fragments) is easy.

-- 
       ~ g r @ eclipsed.net


______________________________________________________________________
Philadelphia Linux Users Group       -      http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion  -  http://lists.phillylinux.org/mail/listinfo/plug