<html><head></head><body><div class="ydp51b3478cyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false">OK, now I'm the one who is math challenged.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Suppose
there are 70 characters (upper case, lower case, numbers, etc) A 32
character password could have 32^70 or 2E105 possibilities.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">If
a password is made of 4 words, and there are 500 words in the
dictionary 4^500 = 1E301 possibilities. English has a lot more than
500 words, but LO calc doesn't handle numbers much larger than that.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Why is the second example no good, just because someone with mal intent might have the same dictionary? <span>There are lots of encryption schemes where the algorithm is well known, but you can't use it without knowing the key.</span><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">IMO,
a good way to enhance security is to deliberately limit the number of
tries per second. At some banks, more than a handful of wrong login
attempts will lock the account.<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">On
a related note, I had deliberately created different users names on
different systems. It's not exactly secure, but it provides a little
more difficulty. Lately I find that more and more websites want my
email as user name. It's not that I don't want the site to have my
email for my account. I just want the little extra security.</div><div dir="ltr" data-setdir="false"><br></div>So where did I get this wrong?</div><div><br></div></div><div><br></div>
</div><div id="ydpe439b6e5yahoo_quoted_6620356714" class="ydpe439b6e5yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, March 30, 2020, 3:35:02 PM PDT, Tony Godshall <tony@of.net> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="ydpe439b6e5yiv5323795119"><div><div><div><div class="ydpe439b6e5yiv5323795119yqt3533220088" id="ydpe439b6e5yiv5323795119yqtfd34116"><div>On Mon, Mar 30, 2020, 1:20 PM Rick Moen <<a shape="rect" href="mailto:rick@linuxmafia.com" rel="nofollow" target="_blank">rick@linuxmafia.com</a>> wrote:</div><div><br clear="none"></div><div>> I would suggest that -- at least according to my own criteria and usage model, so adjust to suit -- a more-reasonable strategy is a modified</div><div>version of the famous/infamous XKCD 'password strength' algorithm. Partial discussion is here: <a shape="rect" href="https://security.stackexchange.com/questions/62832/is-the-oft-cited-xkcd-scheme-no-longer-good-advice" rel="nofollow" target="_blank">https://security.stackexchange.com/questions/62832/is-the-oft-cited-xkcd-scheme-no-longer-good-advice</a></div><div><br clear="none"></div><div>> To get past the otherwise-inevitable wasted-time discussion, Schneier said that the _literal_ use of the XKCD method (merely stringing</div><div>together dictionary words) was obsolete. But that doesn't mean that the general approach if modified to foil dictionary attack doesn't have </div><div>merit.</div><div><br clear="none"></div><div>> (I'm not going to state exactly how I arrive at passwords, for the self-evident reason that I don't want the world to know exactly how I</div><div>arrive at passwords.)</div></div></div><div><br clear="none"></div><div>I would also suggest that whatever password scheme you currently use, you periodically alter it in an arbitrary fashion, sometimes in some way that varies per site, or domain. Like inserting a punctuation mark in the 8th position, or deleting the third character, or prefixing the second letter of the domain or hostname you are connecting to. That way you can improve the nonguessability of your passwords over time, while at the same time reducing the amount you need to memorize at a time. Once the prior password becomes second nature, and all hosts have been updated, you can move onto the next permutation. Eventually your password becomes as line noise and nobody can guess that you started with a less than ideal password. </div><div class="ydpe439b6e5yiv5323795119yqt3533220088" id="ydpe439b6e5yiv5323795119yqtfd74767"><div><br clear="none"></div><div><br clear="none"></div><div><div class="ydpe439b6e5yiv5323795119gmail_quote"><blockquote class="ydpe439b6e5yiv5323795119gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><br clear="none"></blockquote></div></div></div></div></div></div><div class="ydpe439b6e5yqt3533220088" id="ydpe439b6e5yqtfd85118">_______________________________________________<br clear="none">conspire mailing list<br clear="none"><a shape="rect" href="mailto:conspire@linuxmafia.com" rel="nofollow" target="_blank">conspire@linuxmafia.com</a><br clear="none"><a shape="rect" href="http://linuxmafia.com/mailman/listinfo/conspire" rel="nofollow" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br clear="none"></div></div>
</div>
</div></body></html>