|
Message-ID: <51F796D6.2030107@banquise.net> Date: Tue, 30 Jul 2013 12:35:02 +0200 From: Simon Marechal <simon@...quise.net> To: john-users@...ts.openwall.com Subject: Re: Joseph Bonneau- The Science of Guessing On 29/07/2013 04:19, Matt Weir wrote: > RockYou is still a pretty good training set for online passwords I did not re-read the paper in details (just looked at table V), but I remembered something slightly different : rockyou same-password count distribution is very close to their own distribution. But as they do not know the actual passwords, it is not possible to conclude that the rockyou list would work well. I wasn't too impressed with the applicability of the paper. They model resistance against on-line attacks conducted by an someone who knows the exact distribution of passwords in use at the target site. The problem is that it is hard to conclude this is a realistic approximation[*], except against sites similar to rockyou ... Table V shows that an optimal dictionary for English people cracks 8% of the passwords against English users, but only 4.2% against French. This is for 1000 attempts, so it seems that having specialized dictionaries is a good idea when you only have a few shots. It is too bad they didn't include the same figures for more intensive cracking sessions. [*]: OK, this is probably a good approximation, especially when you only have a limited number of attempts before you are locked out.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.