Your Password Complexity Requirements are Worthless
summary
Password complexity rules and JavaScript strength meters fail because modern crackers exploit predictable topologies, not brute force: a LinkedIn dump becomes 97% cracked using pattern-based rules and fast tools like Hashcat; a consumer $2,000 GPU rig cracks NTLM eight‑char passwords in days. Analysis shows the top 100 patterns → 85% cracked in enterprises (top five cover ~48%), so blacklisting common patterns and using slow hashes (bcrypt/scrypt) plus 2FA matters. A Linux Pathwell PAM module is built to ban common topologies and diversify real-world passwords.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:18Naive bruteforce (impractical) . Wordlists (Names, places, sports, company names) • Mangling rules (Such as, capitalize first letter) . Markov Chains mathematical patterns based on position of letters next to other letters
- 6:56Password reuse. (Linkedin example). • Rule generation based on previous data, • Rule generation based on user-base or source of password leak (Link Linked Linkedin Linkedin ) • Pattern Based (topologies) . This is what we are here to talk about. . This is what we _should be defending against.
- 12:47Some sites do not even hash their passwords at all. And end up being shamed publicly.
- 36:06Topology Related Defense: What are some ways we could use this knowledge to level the playing field? - Blacklist the most common, predictable topologies Don't allow multiple users to stack up on the same topology - force them to spread out. Wear Level them across the possible topology space. (Advanced topic). . Require a minimum topology change between old and new
related talks
25mEverything You Know About Passwords Is Wrong
31mBreaking Bad (Passwords)
30mhunter2: A Symphony of Password Horror
23mFantastic Passwords and Where to Find Them
40mFantastic Passwords and Where to Find Them
14mPasswords. Are. Not. Hard!
27mThe Wide Diversity of Password Requirements – And how to cope with it
27mKeeping passwords safe in 2017