That's OK, I'm behind seven proxies.

päSsW¤rd1

I believe 12345 meets all those criteria.

The US DOT recently changed its discussion board. The old system didn't require a password. You typed a name and that's how your post appeared. The questions were like "My agency recently installed some W29-307B symbolic dingo crossing signs. How long should we maintain the supplementary `Dingo Crossing' plate?" They hardly needed much security.

Somebody official noticed the government-run system did not meet government security standards. The result was a new requirement for prior approval of posting and use of a 12 character password with circles and arrows and a paragraph on the back of each one explaining how the character was secure against Canadian sign thieves. And a comparatively dead board.

A dingo ate my babby.

1-2-3-4-5-dingÖ

ArkAngel

You forgot the gerund: 1-2-3-4-5-dingÖing

apart from my html fail.

That's great and all but most websites don't let you guess the password that many times a day, let alone per second.

jaylectricity

These machines are for offline cracking. Some sysadmins who ought to be put to death slowly and painfully allow hackers to steal their password databases. Some don't even bother making the databases hard to crack.

It's easy to design a system where the password database doesn't live on the web server. We had that when I was in college in the 1980s (minus the "web" part). The hashed version of your password lived in an encrypted file on a disk in a locked closet, attached to a secured server. That server talked to the outside world through an authentication protocol. I'm not sure if it even allowed remote logins.

You to workstation: Hi, I'm Drew.
Workstation to auth server: Hey, this guy says he's Drew, send me a blob of data.
Auth server to workstation: Here's your blob.
Workstation to you: Password, please.
You to workstation: 12345
Workstation to auth server: Here's your blob decrypted using what this 'Drew' says is his password and re-encrypted with the key I found inside.
Auth server to workstation: It's a match! He's cool.

I've skimmed over technical details of what gets encrypted and decrypted. See Kerberos authentication system. The important part is, the auth server is designed to assume client machines and the network are both insecure.

ZAZ: jaylectricity

So if they have access to the physical storage of passwords, don't they have access to anything they want anyway?

So if they have access to the physical storage of passwords, don't they have access to anything they want anyway?

Depends on the circumstances.

Some of these crackers are looking to exploit people who reuse passwords. Maybe they don't care about LinkedIn, but figure LinkedIn users have access to the secret Federal Reserve bboard.

In the old Kerberos system I described if you get to the database and the master key (which requires peeking inside process memory on a secure server) you win. The network is set up to trust the authentication server.

Some web servers are misconfigured so you can do HTTP GET /etc/passwd (or equivalent), giving you read access to hashed passwords, but not more valuable data.

That's why I don't use any online services that require a password.

ampoliros: unless your site is really poorly configured

There are a lot of poorly configured sites, or sites using poorly configured hosting providers.

We should treat these sites like people who refuse vaccinations for the core plague-causing diseases, or people who leave guns or unlocked cars around to be stolen.

Oh, well then I'll start requiring users to submit passwords that include an O, 0, ∅, and Ø. Just so you can't figure it out when written down. And then, we'll require Egyptian Hieroglyphs, for good measure.

LOL...my wife is a paranoid BS in CS, so she refuses to run Java, scripts and a bunch of other shiat I can never recall, and she uses a ~20 digit password for everything...that she won't type...instead copy pasta from a text file.

Of course, she can only actually view about one page in three she clicks on, and can only change web pages about every 30 seconds, but nobody can see her baby pics.

*rolls eyes*

ChubbyTiger: jaylectricity: ZAZ: jaylectricity

So if they have access to the physical storage of passwords, don't they have access to anything they want anyway?

Yes and no. Think about it like this. They hack Fark and get the passwords, in hashed format. Then they crack the file (offline). Now they have your email address and a password. Sure, that password is the one you use for Fark, but how much do you want to bet that 50% of the Fark passwords also work for a banking site or Amazon (where they have your credit card), or Facebook (where they get tons of other information), etc.

That's why my Fark password isn't particularly difficult. I'd rather the goblins think they've scored big when the truth is they only stole my collection of farts in mason jars. I'd miss it but not that much.

Most of America still thinks that the best way to deter password thieves is to make their password hard to guess.

When was the last time you saw a McDonald's employee trying to do something without a computer? Hackers are not sitting there with a pen and paper jotting down possible password.

Smeggy Smurf: I'd rather the goblins think they've scored big when the truth is they only stole my collection of farts in mason jars. I'd miss it but not that much.

I particularly enjoyed pineapple salsa fart #4, 1998. It was a good year.

meyerkev: Stone Meadow: LOL...my wife is a paranoid BS in CS, so she refuses to run Java, scripts and a bunch of other shiat I can never recall, and she uses a ~20 digit password for everything...that she won't type...instead copy pasta from a text file.

Of course, she can only actually view about one page in three she clicks on, and can only change web pages about every 30 seconds, but nobody can see her baby pics.

*rolls eyes*

As a fellow (pending. 1 more paper) BS in CS, and de facto family tech guru, she's right.

Basic rule:

Extensions:
Adblock - turn off ads
Flashblock - keep flash from running until you say so
Turn off Java
No(t)Script(s) - Turn off Javascript selectively.

Of course, NoScript breaks the internet, so I usually go with the first 3 until they get a virus, and then I give them NoScript, and a basic whitelist for most of their sites.

/Currently running without NoScript. It really does break the internet.

I told her about ratting her out on Fark and she said to mention that she doesn't keep any passwords or account numbers on her laptop's HD, either. Instead, she keeps them on an encrypted thumb drive that she sticks in when she needs it. Oh, and she never uses the "remember me" option with websites, either; empties the trash and dumps cookies when she logs off, etc.