[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 30 Jul 2013 12:35:02 +0200
From: Simon Marechal <simon@...quise.net>
To: john-users@...ts.openwall.com
Subject: Re: Joseph Bonneau- The Science of Guessing
On 29/07/2013 04:19, Matt Weir wrote:
> RockYou is still a pretty good training set for online passwords
I did not re-read the paper in details (just looked at table V), but I
remembered something slightly different : rockyou same-password count
distribution is very close to their own distribution. But as they do not
know the actual passwords, it is not possible to conclude that the
rockyou list would work well.
I wasn't too impressed with the applicability of the paper. They model
resistance against on-line attacks conducted by an someone who knows the
exact distribution of passwords in use at the target site. The problem
is that it is hard to conclude this is a realistic approximation[*],
except against sites similar to rockyou ...
Table V shows that an optimal dictionary for English people cracks 8% of
the passwords against English users, but only 4.2% against French. This
is for 1000 attempts, so it seems that having specialized dictionaries
is a good idea when you only have a few shots. It is too bad they didn't
include the same figures for more intensive cracking sessions.
[*]: OK, this is probably a good approximation, especially when you only
have a limited number of attempts before you are locked out.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
