HOW SECURE IS YOUR PASSWORD ?

[mattx]

A neat little test, although typing your passwords into a random site that knows your IP address is possibly dumb.

 

How Secure Is My Password?

[DarrenM]

So does it just tell you that every password you are dumb enough to put into it is now not secure?

[webman]

It doesn't transmit passwords back to the site at all - it's just javascript code that runs in your browser.

 

But good news - my strongest password will take About 66 quintillion years to crack and my next strongest About a million years

[featured_spectre]

according to this mine would take

 

"About 740 octodecillion years"

 

lol...thats what you get for having a 32 digit letter and number combination password

[tom_newton]

Read the source. Author is a div. For example, adding entropy to your password does not necessarily make it stronger - the possibility of the existance of uppercase (forcing the attacker to use a larger seachspace) is more important than their actual use, for example. So the password's strength can't be determined by the password alone. Simplistic nonsense. Grr.

[Gatt]

Miine is really secure - its stuck to the bottom of my keyboard with superglue...

[PiqueABoo]

the possibility of the existance of uppercase (forcing the attacker to use a larger seachspace) is more important than their actual use,

 

Disagree.. the attacker is only forced to crack the entire password space when they **know** that password space is enforced e.g. some kind of complexity checking is turned on. Even then attacker would be an idiot not to try dictionary based cracks with something like the JtR rules to get the "MyPassword01!, MyPassword02!, ..." stuff. And if they don't know what password space is enforced, it's opportunistically try the same JtR-like approach and usually whatever capability rainbow tables they have or have the patience to use.

 

Bottom line: "mypassword" falls out relatively quickly regardless of whether more complex passwords are possible.

Edited January 30, 2011 by PiqueABoo

[vikpaw]

Read the source. Author is a div. For example, adding entropy to your password does not necessarily make it stronger - the possibility of the existance of uppercase (forcing the attacker to use a larger seachspace) is more important than their actual use, for example. So the password's strength can't be determined by the password alone. Simplistic nonsense. Grr.

 

I'm sure smoothwall tweeted that or something similar a while back.

 

Anyway, in your expert opinion, can you tell us, Does size matter?

[vikpaw]

actually maybe it was this that i got off twitter, interesting info on time to crack password:

 

http://www.lockdown.co.uk/?pg=combi

[tom_newton]

@piqueaboo: Looking at standard JTR rules would indeed be a better way to infer "strength" (against that attack at any rate) - maybe I was not clear - yes, an all-lc password (especially a dictionary based one like your example) is more likely to be bruteforced, but if you look at the algorithm used in the site we're talking about, it directly judges strength based on addition of a letter/number/etc. which makes naive assumptions that all attackers will brute passwords in just the same way. I was using lower/upper as just a "first example" here of the quality of the result

 

On a more general level, I would suggest that "brute force" attacks are extremely rare, and as such, a measure of a password's security against brute force is not far from measuring a nation's security by its ability to repel an army of clowns riding unicycles.

"Not having been typed into an arbitrary website" would be a good starting point for a metric. IMO password entropy between a user's passwords is more important than entropy within.

 

Vik: Length? Matters up to a point, but once it's long enough, the rest is just showboating. Interestingly the usual measure of long enough is given as "just over 6" (characters)