Caedis

Have you ever typed in your password while logging into a page and it has that little password strength bar on it that fills up the more you type? How accurate is it? Can you even trust such a novel multi-colored doo-dad?

Why guess? I went to the trouble of getting together a spreadsheet that can definitively tell you exactly how secure you are using that password of yours. It can even give suggestions as to how to improve your password. Be warned, it’s not always pretty to see the honest truth.

(Updated 6/5/09)

• Added extended data validation to prevent accidental entry of erroneous data.
• Cleaned up the document to fix some grammatical errors
• Added a "Galactic Years" option that gives a better frame of reference for larger passwords.
• Additional tweaks and fixes to improve visibility and visual appeal.

(Updated 6/4/09)

I took all the comments and criticism I received and revamped the calculator to use speeds derived from the Nvidia GTX295 to calculate estimated brute force times.
Additionally I added a box at the bottom of the calculator that can be used to quickly and easily copy your score to any forum or blog you want. A solid password really is something to be proud of, show it off!

Here's my good password-

Quote:

All times relative to Nvidia GTX 295 GPU assuming ~4788000000000 Keys/Sec Password length of 44 Total Password Entropy of 1.44648363739316E+56 Estimated time to crack: Days 629,387,547,598,665,000,000,000,000,000,000,000,00 0,000.00 Years 1,723,205,997,972,500,000,000,000,000,000,000,000, 000.00 Centuries 17,232,059,979,725,000,000,000,000,000,000,000,000 .00 Galactic Years 7,658,693,324,322,230,000,000,000,000,000.00 BULLETPROOF password Get this test at http://bruteforce.caedis.net

Additionally if you want to link to the calculator I have added a entry in my domain name for just such a purpose:
http://bruteforce.caedis.net
Link there if you plan to repost, don't link directly to the file. (as I have been approached by several people already about this)

What is brute force?

Brute force attacks are when your password is guessed by blindly going from one password to the next without little or no reguard for what is being tried. Bascially doing the following:

1. a
2. aa
3. ab
4. abc
5. abc1
6. abc11
7. abc12
8. abc121
9. abc122

As you can see it’s just adding more onto the guess until it gets it right.

This method is the only remaining method to get passwords in situations where the person hasn’t put any real words or significant dates or numbers into the password.

If the person does put words or significant combinations of numbers (like anniversaries or birthdates) then a dictionary attack is usually tried first as it is exponentially faster.

When multiple combinations of common words or combinations of words/numbers are checked. This is often done first as it can sometimes take SECONDS to crack a password this way. If you have a password such as “myDogSkip” the cracker will just have to combine “my” “dog” and “Skip” into the right order to get the password. When this is especially effective is when the person knows even a little about you. Many times this is done by simply asking a friend/co-worker off-hand about some trivial part of your life. Your dogs name? Your wife’s name? or even more easily by going to your Facebook or Myspace page and getting a few key words off it. Think of all the words you use on your profile pages, then think if ANY of them could be used in any way to get a password of yours. If the answer is anything but a strong “NO” then you probably need to re-evaluate what you have secured with that weak password. Which is worse? Identity theft, or an annoying password that’s hard to type in quickly?

Originally posted on my blog at Caedis.net

__________________
How-to: Linux Gaming Explained | How-to: Nvidia Overclocking in Linux | How-to: Linux Temps and System Monitors
How-to: Demystifying the Nvidia Driver

JOKesTER

Wow - I Really Don't Get The Point Of This...

Maybe People Who Haven't Used "Noob" Programs Like "Cain And Able" Actually Don't Know This.

__________________
||| The All Powerful JOKesTER |||

Outcasst

It says my password would take 2.7 Years to crack using an average single machine

__________________
"Aoccdrnig to rscheearch at Cmabrugde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a tatol meses and you can sitll raed it wouthit a porbelm. This is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe."

SiNiSt3r

good guide for people that don't really understand how all this stuff happens, and believe that it will never happen to them.

I can't tell you how stupid people can be with their passwords....

user: root
passsword: control

rofl

__________________

gonX

Mine is around 18 letters long with capitalization and numerics, so good luck cracking that

__________________
THE Mouse FAQ | 32-bit Resolution Fix | Important Information
64-Bit Driver Signing Fix | The Infraction and Warning System
My Anime Progress | The HoN Discussion Thread

Please direct all tech related questions to a thread in the respectable forums, and not to my PM inbox. Thank you

JOKesTER

Thats Why Dictionary Attacks Are Normally Used For Password Cracking - LOL - Not Bruteforce.

__________________
||| The All Powerful JOKesTER |||

Caedis

If you don't get the point then you fall into one of two categories:

1. You already know about this and it's common sense for you, in which case this isn't directed towards you.
2. You don't care to know about this and couldn't care less about your security, in which case this isn't the right forum on OCN for you.

In either case, it's eye opening to find out how much of a beating a previously perceived as "strong" password can take before it is cracked.

__________________
How-to: Linux Gaming Explained | How-to: Nvidia Overclocking in Linux | How-to: Linux Temps and System Monitors
How-to: Demystifying the Nvidia Driver

JOKesTER

That Would Be #1

__________________
||| The All Powerful JOKesTER |||

Caedis

Feel my wrath!


Estimated Gross Number of hours to Crack 1.09E+46 hours
On Distributed Level:
456,063,990,862,240,000,000,000,000,000,000,000,00 0,000,000.00 days

1,248,661,826,106,260,000,000,000,000,000,000,000, 000,000.00 years

12,486,618,261,062,600,000,000,000,000,000,000,000 ,000.00 centuries


44 chars of garbled alphanumeric/symbolic trash.

No joke, it's committed to muscle memory. I stumped one of my computer science professors in college by typing it out in plain text for him. His jaw dropped XD

__________________
How-to: Linux Gaming Explained | How-to: Nvidia Overclocking in Linux | How-to: Linux Temps and System Monitors
How-to: Demystifying the Nvidia Driver

antd

I use KeePass for my passwords. Creates 64 character 'random' passwords using all symbols, letters and numbers for website's which allow that many

One thing that is unlikely to change fast: People using dumb dictionary passwords.

Do you know how many people put their password as 'sexy' ? XD