Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 
870 posts

Ultimate Geek

Trusted

  #1023105 10-Apr-2014 20:43
Send private message

Lias:
itxtme:
Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.



I would love to see you hit the IRD login system 5 billion times.......


Always assume that a vulnerability somewhere down the line will see the password DB dumped. It's been done time and time and time again.


Depends on what sort of hashing they're doing. NTLM is pretty easily cracked these days, other algos not so much.




 




Human
2978 posts

Uber Geek

Subscriber

  #1023271 11-Apr-2014 10:17
Send private message

Peppery:
Lias:
itxtme:
Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.



I would love to see you hit the IRD login system 5 billion times.......


Always assume that a vulnerability somewhere down the line will see the password DB dumped. It's been done time and time and time again.


Depends on what sort of hashing they're doing. NTLM is pretty easily cracked these days, other algos not so much.


plus, all it takes for most people these days is a search around the internet to get an idea what they might be using for a password; for some older people I know, they have their favourite pets plastered across their social media pages and I know for a fact that at least one or two of them use their pets names as passwords.

Removing the requirement for case sensitive passwords increases the risk, more so in those cases where someone is being specifically targeted.


Oh and yes, truncating it, again, lessens the security of the password as well.






 
 
 
 


1330 posts

Uber Geek


  #1023930 12-Apr-2014 13:43
Send private message

Not having case sensitive passwords is fine by me.  

It likely saves them a lot of support costs "waaah IRD I can't login", "see that shining light on your keyboard, yeah, that's CAPSLOCK, turn it off".

You know who pays for the IRD support costs, I do!  And you.  And him over there.  But not that guy, parasite.

Obligatory





---
James Sleeman
I sell lots of stuff for electronic enthusiasts...


23294 posts

Uber Geek

Trusted
Subscriber

  #1024520 13-Apr-2014 20:20
Send private message

The number of times people at work have been locked out of things for having caps lock on or else numlock off and trying 3 times and then having to call up and reset has probably cost the bank 100's in call center costs. If there is a lockout for too many incorrect attempts then its not a big deal and would save them support costs.




Richard rich.ms

1 | 2 
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

OPPO Find X2 Lite brings flagship features to mid-range 5G smartphone
Posted 29-May-2020 12:52


Sony introduces the digital camera ZV-1 for content creators
Posted 27-May-2020 12:47


Samsung Announces 2020 QLED TV Range
Posted 20-May-2020 16:29


D-Link A/NZ launches AI-Powered body temperature measuring system
Posted 20-May-2020 16:22


NortonLifeLock Online Banking Protection now available for New Zealand banks
Posted 20-May-2020 16:14


SD Express delivers new gigabyte speeds for SD memory cards
Posted 20-May-2020 15:00


D-Link A/NZ launches Nuclias cloud managed network solution hosted in Australia
Posted 11-May-2020 17:53


Logitech introduces new video streaming solution for home studios
Posted 11-May-2020 17:48


Next generation Volvo cars to be powered by Luminar LiDAR technology
Posted 7-May-2020 13:56


D-Link A/NZ launches Wi-Fi Certified EasyMesh system
Posted 7-May-2020 13:51


Spark teams up with Microsoft to bring Xbox All Access to New Zealand
Posted 7-May-2020 13:01


Microsoft plans to establish its first datacenter region in New Zealand
Posted 6-May-2020 11:35


Genesis School-gen has joined forces with Mind Lab Kids
Posted 1-May-2020 12:53


Malwarebytes expands into privacy with fast, frictionless VPN
Posted 30-Apr-2020 16:06


Kordia to donate TV airtime on Channel 200 to community groups
Posted 30-Apr-2020 16:00



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.