# 密碼強度

## 廢密碼

### 常用詞彙版

 123456 12345 123456789 princess password 111111 654321 Password iloveyou abc123 12345678 1234567 88888888 87654321 rockyou qwerty abcdef admin 0000 123qwe

### 睇落去好似好難估，但好易被估到嘅組合版

 123qwe qazwsx qwerty qweasd 1qaz2wsx 123qwezxc qweasdzxc asdfgh 1q2w3e 147258

## 堅嘅密碼

t3wahSetyeT4 雖然唔係字典入面嘅破解詞，但佢包括咗大小寫同阿拉伯數字嘅組合。
4pRte!ai@3 雖然唔係字典入面嘅破解詞，但佢包括咗大小寫同阿拉伯數字、標點符號嘅組合。
MoOoOfIn245679 密碼比較長，兼有大小寫字母同阿拉伯數字組合。
Convert_600£ to Euros! 典型一句英文句子，好長，兼有小寫同阿拉伯數字、標點符號嘅組合。
yida124579yida 一堆阿拉伯數字同隻拉丁字喺前後，一般用喺好多個戶口或校園網、公司企業內網整密碼時用。
Tpftcits3Utg! 包括咗大小寫同阿拉伯數字、標點符號嘅組合。呢種噉嘅密碼即使用運算比較快嘅電腦都好難破解到。

### 亂嚟嘅密碼

[未記出處或冇根據]穏陣嘅密碼係一長串亂嚟嘅字元, but such passwords are generally the most difficult to remember. For the same number of characters, a password is stronger if it includes a mix of upper and lower case letters, numbers and other symbols (when allowed). The difficulty in remembering such a password increases the chance that the user will write down the password, which makes it more vulnerable to a different attack (in this case the paper being lost or stolen and the password discovered). Whether this represents a net reduction in security depends on whether the primary threat to security is internal or external.

A password can, at first sight, be random, but if you really examine it, it is just a pattern. One of these types of passwords is 26845. Although short, it is not easily guessed. But the person who created the password is able to remember it, because it's just the four direction keys on the square number board (found at the right of most keyboards), plus a five in the middle. If you practice it, it is just one swift motion of moving 2 fingers around the board (which is very easy to use).

Forcing users to use system-created random passwords ensures the password will have no connection with that user and shouldn't be found in any dictionary. Several operating systems have included such a feature. Many also include password aging, requiring users to choose new passwords regularly, commonly after 30 or 45 days. Many users resent such measures, particularly in the absence of effective security awareness training. The imposition of strong random passwords may encourage users to write down passwords, store them in PDAs or cellphones, share them with others against memory failure, increasing the risk of disclosure.

The following measures can increase acceptance of random password use, if carefully used:

• Create a training program. The initial advantages of random passwords need to be laid out for people. Also, update training for those found to disclose passwords.
• Reward users of random passwords by reducing the rate of forced password changes to periods longer than 3 months. Typically 4, 6 or 12 month forced password reset periods work. Spreading out the password change process may have an advantage to human memory processes.
• Compensate for disclosed passwords by building a vigilant account closure process for departing users and/or a process to show each user a last login notification banner.
• Automate a password reset system as a safety net. This will also reduce Helpdesk call volume concerning password resets. This must be done with care, however, because easily guessable password reset keys bypass the advantages of a strong password system!

Passwords can be found by using so-called brute force password generators. In the simplest case, these are small programs that simply try all possible combinations. A 3 GHz processor can generate approximately 3 million passwords a second. A ten letters password such as '4pRte!ai@3', because there are about 95 keys available, is one of ${\displaystyle 95^{10}}$ possibilities, which would take approximately 632860 years to be found assuming purely random possible password generation. A password containing fifteen random upper-case letters would be just as safe and might be easier for some people to remember and type.

### Training

User training versus a cracking time metric for large user base password files:[未記出處或冇根據]

User training actions Metric: 50% password hashes cracked
No Training Time ≤ 2 minutes
Sporadic User Training Time ≤ 4 minutes
General User Training Time ≥ 45 minutes
Focused User Training Time ≥ 24 hours
Motivated User Population Time ≥ 1 week
Random Password Group Time ≥ 2 weeks
Contest Winners Time ≥ 1 month

Note: times are based on reports from authorized password cracking efforts that used John the Ripper, without a dictionary, on Microsoft LM Hashes, run on a Pentium 4, 2 GHz system. Only results from password files containing greater than 3,000 password hashes are included.[未記出處或冇根據]

Pre-computed rainbow tables represent a determined computing investment. The greater the range of keys included and the length in password places covered, the greater the number of combinations to compute, and the greater the expense of time or money to obtain them.

Factors to consider

• Key space
• Investment in computer time
• Parallel computing team coordination
• Raw patience of a determined computing effort
• Predictive accuracy
• Encryption type
• Storage space
• Distribution or purchase costs

Rainbow Table Defenses

• Exceeding the password length of commonly available tables.
• Exceeding the keyspace of commonly available tables.
• Avoiding the use or exceeding the useful length of old hashing methods.
• Preventing the capture of password hashes.
• Using salts.

## Passwords weakened by hashing vulnerabilities

Knowing which password hashing methods are used to protect your password can help you choose a more effective one. In this training example the effect of position in password selection is illustrated. Microsoft has updated its password hashing methods over time, but the LM hashing method often remains because of backward compatible features of newer Microsoft systems.

Training Samples to avoid.

Crunchy Bad It is a word. 100,000 words can be tested in less than 0.03 seconds.
Crunchy! Bad The symbol "!" amounts to a second, single digit, password and will not last long.
CrunchyPretzel Bad "Pretzel" amounts to a second password, that is a word.

Why are these sample passwords at risk?

• Each 7 places in a Microsoft LM password hash may be cracked separately.
• These passwords show unfortunate placement problems in LM hashing protection.
Password Full Length Cracking Lengths First Half 1 2 3 4 5 6 7 Second Half 8 9 10 11 12 13 14
Crunchy 7 7 + 0 Crunchy C r u n c h y
Crunchy! 8 7 + 1 Crunchy C r u n c h y ! !
CrunchyPretzel 14 7 + 7 Crunchy C r u n c h y Pretzel P r e t z e l
• LM hashing is only used by Microsoft for passwords of 14 places or less.
• Longer passwords will not be subject to backward compatible hashing weakness.
• By evading LM hashing, substantial improvements in cracking delay are added.
• An extra password place beyond 14 can frustrate a cracking effort by millions of years by avoiding LM password hashing.
• Such a plan can work even inside a network where shorter passwords are backward compatible to LM hashing.
• Support and use of LM hashes can be turned off if no pre-Windows 2000 systems are in use.[19]

Computer users are generally advised "never write a password down anywhere, no matter what" and "never use a password for more than one account." These maxims, while sound in theory, ignore the reality that an ordinary computer user may have dozens of password-protected accounts. The multitude of accounts often ends up with users having the same password everywhere. A user's attempt to comply will often result in many forgotten passwords, even for important accounts.

If passwords are written down, they should never be kept in obvious places such as address books, Rolodex files, under drawers or keyboards or behind pictures. Perhaps the worst, but all too common, method is a note near the computer. Better locations are a safe deposit box or a locked file approved for information of comparable sensitivity to that protected by the password. Software is available for popular hand-held computers that can store passwords for numerous accounts in encrypted form. Another approach is to use a single password for low security accounts and select separate, strong passwords for a smaller number of high-value applications such as online banking. Manual or offline forms of this approach are also in use. For example, a phone directory may be used to keep a map between computer accounts and password hints.

The problem of password overload is quite real. Certain IT professionals may manage from 25 to 250 privileged passwords at any one time. In such cases, some safe storage area for password hints, private key or encrypting password become unavoidable.

At a 2005 security conference, an expert from Microsoft was quoted as saying: "I claim that password policy should say you should write down your password. I have 68 different passwords. If I am not allowed to write any of them down, guess what I am going to do? I am going to use the same password on every one of them."[20]

Whether it is worse to use weak passwords that are memorized or strong passwords that are written down can provoke fierce debate among experts. Practical security often requires balancing conflicting imperatives such as security requirements and human factors.

The problem was addressed in an interesting way by Steve Gibson during his "Security Now" podcasts with Leo Laporte; he suggested creating not a password, but a password algorithm that could be universally applied to a company name or other unique indicator. A simple algorithm, such as using every other letter from a name, would generate the password wkpda for a Wikipedia password; although this example is a fairly low-security password, minor variables to include numbers, capitalization and symbols can generate a password which is seemingly random, difficult or impossible to remember, but easy to re-generate at any time.

Rather than writing the passwords themselves, some write lists of cryptic clues to their own passwords that have relevance through personal experience. For example, if your favorite movie was Terminator and your cat's birthday was 2007-04-10 you could describe the password "terminator0410" as "Favorite movie cat is born without years".

In case that it may happen that you need to type the password while being abroad on a different PC, then consider that the PCs abroad may have a different keyboard layout than yours, and you should avoid passwords containing chars that are not present in other keyboard layouts.

Passwords can be discovered by shoulder surfing, burglary, extortion, blackmail, threats, or other methods. Information diving is surprisingly fruitful for situations in which sensitive printed data is discarded with insufficient precaution; it is said to be part of the techniques which have produced the recent rise in identity theft. Approximate password length can be discovered even without shoulder surfing by simply counting keyboard clicks or noting finger motions. Research published by IBM in 2004 shows that each key on a keyboard has a distinctive acoustic signature, allowing keyed in data, including passwords, to be recovered by analyzing recordings from a covert listening device or "bug." See: Acoustic cryptanalysis.

Single sign-on solutions can be an advantage in reducing the risk of password betrayal. However, a person may access separate systems with differing password encryption strengths, password complexity rules, single sign-on product vendors and computer security vulnerabilities.

To help, a person can keep an index of which password is in use with multiple accounts. This strategy can mitigate this risk to some extent. The password use index allows the person to change groups of accounts with identical passwords as needed. But, a password use index should only contain password hints rather than direct password examples. Care should be taken to protect a password use index from easy duplication, sharing, exposure or capture.

## 註同攷

1. 因為黑客攞到其他人嘅個人信息有好多方法：例如買銀行卡數據將指定嘅人銀行卡入面啲餘額洗劫一空、相冊入面嘅「訪問要求密碼」被破解導致私人相被猛咁轉發到周圍都係、網盤密碼被破解導致檔案唔見咗或轉到第度……
2. 呢啲密碼（包括近似字符堆）嘅安全性已經洩漏，唔好再用佢，費事點解會喺其它地方出現俾黑客破解咗嘅情況。
1. Bidwell, Teri (2002). Hack Proofing Your Identity in the Information Age. Syngress Publishing. 1931836515.
2. 100 'most dangerous' passwords to use in 2018
3. 25 'most dangerous' passwords to use in 2017
4. A list of the most dangerous passwords
5. "Most common and dangerous passwords". 原著喺2015年4月5號歸檔. 喺2018年7月7號搵到.
6. As easy as 123456: the 25 worst passwords revealed
7. 10 Most Dangerous Things To Do Online - Claremont Graduate University
8. 101 Data Protection Tips: How to Keep Your Passwords, Financial & Personal Information Safe
9. 75% of people think sharing passwords is dangerous but 55% still do it