Passwords

[cjolley]

Question: is a password that contains repeating words any easier for a computer to crack than one with non-repeating words?

Eg: BananaBanana or BananaReason. The first is much easier to remember, but presumably no more likely to be tried?

Correct, the password cracker does not get a hint of partial matches.
In the case you site though the first one might crack first because the tables are machine generated and BananaBanana comes first alphabetically.

PS. Don't use AfganistanBananaStand

[Umfriend]

So "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" should be pretty OK but "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ" somewhat better?

[dZeus]

and to be paranoid, if you have these settings use them

admin by LAN only.

prevents changing settings by an intruder over the wireless connection, good

enable MAC filtering on wireless so only know MACs are allowed..eg all disabled unless in list.
( i have had modems the filter MAC on wireless and LAN so be careful about locking yourself out)

someone who's going to brute-force your WPA2 password likely also will be able to find the MAC addresses in use by your wireless devices, and copy one. Having to manually add MACs is quite an additional hassle for each new component.

Disable SSID broadcast

DON'T! This adds exactly 0 extra security

and set WPA2 password even.

+ use a very long pass-phrase or preferably (if your devices support it) use a PKI for access (e.g. EAP-TLS).

Also some telco only modems may require you to use there management software to change some settings.

But I would throw out a modem with password that can't be change, if its shared by so many people its just to FAT a target for trojan/hacking.

If you can't secure the wireless connection, agreed.

As long as the modem admin interface isn't exposed to the WAN, you can set a very good wireless pass-phrase and prevent physical access (reset modem to defaults and/or plug in a cable into the modem), then it's not very important (imo).

[Fat Tone]

oooooooooooooooooooooooiiiiiiiiiiiiiiiiiiiiiiiiiii cccccccccccccccccc

[cjolley]

So "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" should be pretty OK but "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ" somewhat better?

Lol. Define "somewhat"

Aren't there programs to steal the pass phrase if they can catch you while you are connecting your own device to the router?

PS Ours is four words: the names of two past pets and two words in Chinese pinyin. Has been for years.

@Tony that's your idea of easy to remember?
How about "+6ugg3r@ff!"

[Evildead666]

Lol. Define "somewhat"

Aren't there programs to steal the pass phrase if they can catch you while you are connecting your own device to the router?

yes

PS Ours is four words: the names of two past pets and two words in Chinese pinyin. Has been for years.

@Tony that's your idea of easy to remember?
How about "+6ugg3r@ff!"

When I did my Wifi security course at for work, they mentioned that overly offensive names for Access Points can lead to a challenge from a hacker.
Even if you don't have your access point visible, when your Laptop etc tries to connect, it 'announces' the AP name over the air. At this point, a 'handshake' occurs, that can be intercepted and decoded, even with WPA etc (Just longer to crack).
When connected, all is fine.

Which is why I use wired connection wherever possible.
You could also get a good Wireless router, that allows you to vary the strength of your signal, so that it doesn't reach outside your house/garden.
If you live in an apartment, you're buggered, get it wired.

The Linksys WRT54GL is a pretty good (linux) router, especially since it can be modded extensively with a reflash of the firmware.

[KRSESQ]

@Brian,
All the more reason to turn off the provider's radio and use your own wifi router.

In some places that could get you a visit from the Secret Police.

[Jammrock]

There are a few ways to make a password secure. If you don't have to enter a password over and over again, like a WPA2 shared key, you can just go wild with it. Create a 32 character jumble of absolute randomness using upper/lower characters, numbers, punctuation and special characters. Just store it securely somewhere for when it's needed.

As for password storage, I prefer to use a tool called KeePass (http://keepass.info/). KeePass uses a heavily encrypted database to store passwords. To get access you need a very strong password and a key file (optional). It's small and can be portable so you can run it off a thumb drive. If you're paranoid about having it on a thumb drive then use BitlockerToGo (Win7) or TrueCrypt to encrypt the flash drive itself.

As mentioned earlier, using punctuation and special characters makes a password harder to crack. Using a larger character set increases the complexity of the password exponentially.

http://en.wikipedia.org/wiki/Password_strength#Random_passwords

And lastly, from the comic, using a long passphrase with random words in it increases the password strength.

Something to remember about brute forcing a password: the times you see quoted are estimates. The actual time can be significantly less or more, depending on how many guesses per second the hack can perform and random statistical luck (where your password shows up in their password database or password generator). With GPU acceleration common these days password cracking can take a matter of minutes to cover every permutation of a password 6 characters or less.

In 2010, the Georgia Tech Research Institute developed a method of using GPGPU to crack passwords much faster.[2] As of 2011, commercial products are available that claim the ability to test up to 2,800,000,000 passwords per second on a standard desktop computer using a high-end graphics processor.[3] Such a device can crack a 10 letter single-case password in one day. Note that the work can be distributed over many computers for an additional speedup proportional to the number of available computers with comparable GPUs. Special key stretching hashes are available that take a relatively long time to compute, reducing the rate at which guessing can take place. Although it is considered best practice to use key stretching, many common systems do not.

Another situation where quick guessing is possible is when the password is used to form a cryptographic key. In such cases, an attacker can quickly check to see if a guessed password successfully decodes encrypted data. For example, one commercial product claims to test 103,000 WPA PSK passwords per second.[4]

If a cryptographic salt is not used in the password system, the attacker can pre-compute hash values for common passwords variants and for all passwords shorter than a certain length, allowing very rapid recovery. Long lists of pre-computed password hashes can be efficiently stored using rainbow tables. Such tables are available on the Internet for several common password authentication systems.

For the record, I've seen rainbow tables in the tens of GB's. Tables that large, with GPGPU acceleration, can crack passwords like you wouldn't believe.

[cjolley]

I would have thought cracking with rainbow tables would be i/o bound.
And no computer shop should be without ophcrack.

[Jammrock]

I would have thought cracking with rainbow tables would be i/o bound.
And no computer shop should be without ophcrack.

You'd be amazed what sort of IO you can get these days.

http://www.fusionio.com/products/iodrive-octal/

On a more realistic scale:

http://www.ocztechnology.com/ocz-revodrive-3-x2-pci-express-ssd.html

Think about this. An enterprise SAN, like the Dell EQ PS6010XV, that runs $68k only gets 26000 IOPS. An OCZ RevoDrive X3 R2 can push 200,000 IOPS for $720 and 230,000 IOPS for $1700. While that's pricey it's doable on any sort of decent income.

Put a couple of those in a RAID 0, load up a nice rainbow table with a GPGPU accelerated password cracker and off you go. Chances are you'll be processor limited more than anything.

[Umfriend]

As mentioned earlier, using punctuation and special characters makes a password harder to crack. Using a larger character set increases the complexity of the password exponentially.

Although I understand this, the hacker won;t actually know whether I use all characters or not, would he? So my take is that as long as your security allows for a large characterset AND it is credible that most users use weird characters, then the hacker would have to go for that and lenght of the PW would be the real determinant of how long it would take. No?

[cjolley]

Although I understand this, the hacker won;t actually know whether I use all characters or not, would he? So my take is that as long as your security allows for a large characterset AND it is credible that most users use weird characters, then the hacker would have to go for that and lenght of the PW would be the real determinant of how long it would take. No?

Also, there is no reason to expire or change passwords because if they are cracked they are used right away.

Both points possibly have some truth to them, but not a "best practice".

[UtwigMU]

I started leaving router passwords default and enabling admin by LAN only. Anyone who can physically access LAN/router is either trusted or if he has broken in, he can probably do more damage than reconfigure router.

[cjolley]

I started leaving router passwords default and enabling admin by LAN only. Anyone who can physically access LAN/router is either trusted or if he has broken in, he can probably do more damage than reconfigure router.

Could someone crack your wifi password and take over your router and enter your LAN?
In other words, are wifi connections part of the local LAN after they are established?

[Umfriend]

On my Sitecom WL router (pw = Harry!Baals?Mike¥Hunt), once your in through Wifi you can do anything.