This discussion will demonstrate some effective methodologies for password cracking and how statistical analysis of passwords can be used in conjunction with tools to create a time boxed approach to efficient and successful cracking.
...
the top 13 unique mask structures make up 50% of the passwords from the sample. Over 20 million passwords in the sample have a structure within the top 13 masks
...
Based on analyzing the data, there are logical factors that help explain how this is possible. When users are asked to provide a password that contains an uppercase letter, over 90% of the time it is put as the first character. When asked to use a digit, most users will put two digits at the end of their password (graduation year perhaps).
So basically math and big data win again. I am not a math whiz but I would guess that even if you increase the password length (add entropy) this type of analysis would still be useful. As long as passwords are in use they are going to be subject to this type of attack.
via Slashdot
No comments:
Post a Comment