Password Generators & Extended Character Set Passwords · PDF filePassword Generators &...
Transcript of Password Generators & Extended Character Set Passwords · PDF filePassword Generators &...
![Page 1: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/1.jpg)
PasswordGenerators &
ExtendedCharacter Set
PasswordsPasswordsCon 2014
Presented by William Gray
![Page 2: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/2.jpg)
Set your new password
Better make it a strong one?
![Page 3: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/3.jpg)
What kind of P@$$w0rd do youchoose?
Divining the future
![Page 4: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/4.jpg)
Maybe this is important?
![Page 5: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/5.jpg)
Do this, don't do that, can't youread the sign?
NYTimes dot com (uses regexes to validate?)
![Page 6: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/6.jpg)
The best it's gonna get
Assuming you're even allowed to use them all!
![Page 7: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/7.jpg)
What's it all for?
Some People think these are good!
![Page 8: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/8.jpg)
Common Restrictions
A pervasive password policy permeating our ether
![Page 9: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/9.jpg)
Is it all for naught?
http://research.microsoft.com/pubs/217510/passwordPortfolios.pdf
![Page 10: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/10.jpg)
correct horse battery staple
http://xkcd.com/936/
![Page 11: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/11.jpg)
Shoe-horning the horseyJKal.Z FY>VA! t\u@$\r #GZuLfM4C0rr3ct h0rse, batt3ry stapl3!Completely random version is very hard to remember
Swapping out chars with similar matches won't stop hashcat
And was it O's or E's or A's you replaced?
![Page 12: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/12.jpg)
So we're stuck?
With fewer than 100 characters for each character in our password
We use password generators and managers or re-use passwords
Hashcat touts 29528 million guesses per second for SHA-1 on 8
graphics cards
![Page 13: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/13.jpg)
What about the rest ofUnicode?
Our basic latin set is in the lower portion of Unicode
In Unicode 7.0 released this June, there are 250,000+ assigned code
points
Imagine that: 250,000^n vs 95^n, what would that look like?
a five character unicode password gives you the same complexity at a
16 char ascii password
![Page 14: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/14.jpg)
Complexity of PINs vs our basicset
![Page 15: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/15.jpg)
Complexity of basic latin vsUnicode
![Page 16: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/16.jpg)
Something must be done!
Let's start generating ridiculous passwords we can't even typeThis is a sample project, it selects randomly from over 55,000 UnicodecharactersBLASTER GITHUB URL GOES HEREThis isn't hard to do
![Page 17: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/17.jpg)
Complexity of basic latin vsBlaster
![Page 18: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/18.jpg)
But is it useful?
We surveyed 25 popular websites, from Alexa top 100 and personalfavoritesWe suspected many would not accept these passwordsWe also thought that maybe by including common restrictions theymight workBy that I mean, 1 digit, 1 upper, 1 lower, 1 meta from the basic set
![Page 19: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/19.jpg)
You Betcha!14 of the 25 accepted Unicode chars beyond our basic setAll disallowing these chars also rejected even if restrictions were metThose accepting Unicode had the least restrictions, most liberalpolicies
![Page 20: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/20.jpg)
Things are gonna change, I canfeel it
Plan:
1. Make this an option in YOUR password generator
2. People will start using them!
3. They will find sites where they can't and then they'll...
EMAAAAAAIL! All those sites and complain complain complain!
![Page 21: Password Generators & Extended Character Set Passwords · PDF filePassword Generators & Extended Character Set Passwords PasswordsCon 2014 Presented by William Gray](https://reader033.fdocuments.in/reader033/viewer/2022051600/5aa34d457f8b9a07758e294f/html5/thumbnails/21.jpg)
Questions? Thoughts?I meant what I said, and I said what I meant
http://zetetic.net@TeamZetetic@billymeltdown