Pass-phrases still not good enough?

[Evan Owen]

 A new password cracking client (ocl-hashcat-plus) has successfully cracked a 55 character long pass-phrase in an astonishingly short period of time and is able to crack up to 64 character pass-phrases.

 

  Short report here: http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/

 

I've personally searched around and couldn't find the greatest information possible on the subject, but this seems to be the best.

[KakaoDj]

If passwords/passphrases becomes insecure, what could we resort to in the future?

[rashdanml]

passparagraphs, perhaps.

[Warcony]

Make everything have 2 step verification?

[chris]

why not just use RSA keys? 2048 bit is enough for everything at the moment, but I still use 4096 bit keys.

[EChondo]

passparagraphs, perhaps.

I really hope you're joking

[rashdanml]

I really hope you're joking

:lol: Yup. If words and phrases aren't good enough, paragraphs are the next step up.

[TopWargamer]

Right as I start to use a passphrase for my accounts as well...what bad luck, eh? 

[criso8]

Putting chips into everyone so the computer can verify who you actually are.

[qwertywarrior]

its using a dictionary attack

nothing special here

as many people have said before USE symbols and uppercase letters with numbers in a 10+ character and ull be fine

[LAwLz]

why not just use RSA keys? 2048 bit is enough for everything at the moment, but I still use 4096 bit keys.

Ehhh, what? That has nothing to do with this at all.

 

Anyway like @qwertywarrior said, if you don't use dictionary words, maybe throw in some numbers and/or special characters then you're fine. Actually, I'd say you're most likely safe right now anyway, since this attack requires them to have access to the hashes, which isn't that common.

Also, using salt a salt when making the hashes makes this attack useless as well.

[qwertywarrior]

Ehhh, what? That has nothing to do with this at all.

 

Anyway like @qwertywarrior said, if you don't use dictionary words, maybe throw in some numbers and/or special characters then you're fine. Actually, I'd say you're most likely safe right now anyway, since this attack requires them to have access to the hashes, which isn't that common.

Also, using salt a salt when making the hashes makes this attack useless as well.

sadly recent hacks to websites show most of them dont salt

[LAwLz]

sadly recent hacks to websites show most of them dont salt

Hopefully websites will take security more seriously with all the recent attacks.

• Salted SHA-1 (or higher) passwords.
• 1024-bit public key for HTTPS (and HTTPS should be forced).
• RC4 or AES for encryption.

This should be minimum for a big site.

 

On a side note, why doesn't LTT allow HTTPS?

[qwertywarrior]

Hopefully websites will take security more seriously with all the recent attacks.

• Salted SHA-1 (or higher) passwords.
• 1024-bit public key for HTTPS (and HTTPS should be forced).
• RC4 or AES for encryption.

This should be minimum for a big site.

 

On a side note, why doesn't LTT allow HTTPS?

HTTPS has been compromised though 

http://www.informationweek.com/security/attacks/https-hackable-in-30-seconds-dhs-alert/240159435

[LAwLz]

HTTPS has been compromised though 

http://www.informationweek.com/security/attacks/https-hackable-in-30-seconds-dhs-alert/240159435

I wouldn't say it has been compromised. I mean, there are ways of breaking it but it's still very difficult.

I am not sure about this, but doesn't HTTPS use different keys for each connection? I mean the public and private key are always the same but the symmetrical key used after the handshake will be different for each connection. Wouldn't that mean that in order to use this attack, they have to target individual connections, and send several thousands of requests per connection. Even if they did that, they would still only compromise the data send during that particular session from that particular user. It would also need them to have access to the same local network . Maybe I am wrong somewhere, but this seems like a very hard thing to pull off and even if it is, it's not a huge deal.