royce

6 ms·

31.
by royce 9y ago
It's a fair point that raw password count is available. But that value is an absolute number, without any in-API context of the total size of the corpus. This makes expressing relative rarity only possible by hard-coding the total
32.
by royce 9y ago
The purpose of a blacklist is multifold - to reduce the efficiency of an offline attack, in which the hashes are stolen and can be attacked at high speeds without rate limiting - as well as an online attack.
33.
by royce 9y ago
While Troy doesn't directly reveal the breaches, it is pretty easy to deduce which public leaks were part of v1 - especially once they're cracked: https://cynosureprime.blogspot.com/2017/08/320-million-
34.
by royce 9y ago
Indeed. One of the authors of 800-63B is actively involved in the password-research community, and is already aware that the guidance places no restrictions on blacklist size.
35.
by royce 9y ago
As a corpus to download for password research, this is indeed useful. But for providing a blacklist -- his stated purpose - it is not. The crucial tell: his API does not allow the implementor to specify a frequency threshold (by top X in
36.
by royce 9y ago
And that's exactly why using this entire corpus - or even more than the first few tens of thousands - as a blacklist would be an extremely user-hostile choice [1]. Password psychology is remarkably consistent across a given demographic
37.
by royce 9y ago
The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they
38.
by royce 9y ago
For most people, a house payment also represents a direct impact to their ongoing cash flow. If your house payment is $2000 a month, paying off your house automatically increases your cash flow by that amount. What else could you do right
39.
by royce 9y ago
Another option, once you have some cash built up and are otherwise diversified, is to occasionally request that the loan be recast . https://www.bankrate.com/finance/mortgages/what-is-mortgage-... Recasting works
40.
by royce 9y ago
Even that is insufficiently precise. Death is not the only thing that separates children from parents. Neglect, disinterest, self-involvement, inability to provide, etc. And beyond a certain minimum viability, no adult is strictly required.
41.
by royce 9y ago
eBay sometimes sends out emails with auction countdowns in them that do something similar. The first time that I saw an accurate countdown ticking away in an email, it surprised the heck out of me.
42.
by royce 9y ago
You're welcome! And "¿por que no los dos?" :) I'll keep the gists updated and will also do a blog post, I think. With a tool like hashcat, a modern GPU or two, and some publicly available wordlists, you can get the vast
43.
by royce 9y ago
I've cracked* just under 99% of them so far (including the 14 million added in Update 1). Statistics are here: https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c9... Regardless of composition, the top 12
44.
by royce 9y ago
A fantastic overview - clear and informed. Thanks very much for this.
45.
by royce 9y ago
Threads discussing rainbow tables are not applicable. These hashes are not unsalted MD5. They are md5crypt ($1$[salt]$[hash]), as found in many Unix-likes and some Cisco IOS.
46.
by royce 10y ago
Twitter OP here. I know the thread's been flagged, but for anyone who finds the thread: he's OK. https://dennisforbes.ca/index.php/2017/02/02/update/
47.
by royce 10y ago
Inside every set of debugging print statements is a debugging verbosity level trying to get out.
48.
by royce 11y ago
I argue that hash substring search activities (vanity hashes, partial collisions, full collisions, etc.) should be brought into the major password-cracking projects - economy of scale, etc. In a way, password cracking is a specific subset o
49.
A call to bring hash substring search into password cracking(roycebits.blogspot.com)
1 points by royce 11y ago|1 comments
50.
by royce 11y ago
This might be useful for that: https://scans.io/study/sonar.ssl
51.
by royce 11y ago
I personally attended a talk presented by Brian Behlendorf at the ISPF (an early ISP conference) in 1999 (which predates the 2000 Linux Magazine article). In his talk, he used the "A Patchy Server" explanation. He made no mentio
52.
by royce 14y ago
I'm not a math person either, but here's some fodder for someone who is. Mark Burnett's extensive password collection (which he acknowledges is skewed, because it's largely based on cracked passwords, he only harvests passwords between 3 an
53.
by royce 14y ago
A stock JtR 1.7.9-jumbo5, using the default rules, is finding quite a few of the non-zeroed ones pretty quickly. This surprises me; I would have expected them to have run the list through the JtR mill before passing it on to others.
54.
by royce 19y ago
You might also want to take a look at LOCKSS (I'm not affiliated; just thought it was interesting): "LOCKSS (Lots of Copies Keep Stuff Safe) is an international non-profit community initiative that provides tools and support so libraries ca