<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Protecting your assets using one word – The Password</title>
	<atom:link href="http://www.gfi.com/blog/protecting-assets-word-password/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.gfi.com/blog/protecting-assets-word-password/?utm_source=rss&#038;utm_medium=rss&#038;utm_campaign=protecting-assets-word-password</link>
	<description>Brought to you by GFI Software</description>
	<lastBuildDate>Fri, 13 Sep 2013 13:27:20 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	
	<item>
		<title>By: Emmanuel Carabott</title>
		<link>http://www.gfi.com/blog/protecting-assets-word-password/comment-page-1/#comment-843</link>
		<dc:creator>Emmanuel Carabott</dc:creator>
		<pubDate>Fri, 11 Dec 2009 10:13:19 +0000</pubDate>
		<guid isPermaLink="false">http://www.gfi.com/blog/?p=1725#comment-843</guid>
		<description><![CDATA[I agree that using special characters will significantly increase the password strength. The reason I didn&#039;t mention that was as it also makes the password harder to remember which is, in my opinion, one of the major issues with people not using strong passwords. In retrospect though I think I should have at least mentioned it. 

If we take an 8 character password which is composed of 3 lower case, 3 upper case and 2 digits we&#039;d have a password that gives about 30 billion combinations; while if it were to be made of 2 lower case, 2 upper case, 2 digits and 2 special characters that would make about 45 billion combinations

More than that, anyone trying to brute force your password might actually not include special characters at all in his brute force set due to the bigger timescale required, thus it would ensure that for that attack your password cannot be cracked at all.

That being said length is obviously your ally as well. In order for a brute force attack to crack the password given in the example: Mc2322UtPaDnW2D an attack needs to be configured to go through 14 qunitrillion combinations (thats 10 to the power of 18). If one adds special characters to this password it can be shortened by a couple of characters and keep the same number of combinations, so just see what&#039;s easiest for your users to remember. In any case both passwords will need 1000s of years to brute force so one should be pretty safe there.]]></description>
		<content:encoded><![CDATA[<p>I agree that using special characters will significantly increase the password strength. The reason I didn&#8217;t mention that was as it also makes the password harder to remember which is, in my opinion, one of the major issues with people not using strong passwords. In retrospect though I think I should have at least mentioned it. </p>
<p>If we take an 8 character password which is composed of 3 lower case, 3 upper case and 2 digits we&#8217;d have a password that gives about 30 billion combinations; while if it were to be made of 2 lower case, 2 upper case, 2 digits and 2 special characters that would make about 45 billion combinations</p>
<p>More than that, anyone trying to brute force your password might actually not include special characters at all in his brute force set due to the bigger timescale required, thus it would ensure that for that attack your password cannot be cracked at all.</p>
<p>That being said length is obviously your ally as well. In order for a brute force attack to crack the password given in the example: Mc2322UtPaDnW2D an attack needs to be configured to go through 14 qunitrillion combinations (thats 10 to the power of 18). If one adds special characters to this password it can be shortened by a couple of characters and keep the same number of combinations, so just see what&#8217;s easiest for your users to remember. In any case both passwords will need 1000s of years to brute force so one should be pretty safe there.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: blak3x</title>
		<link>http://www.gfi.com/blog/protecting-assets-word-password/comment-page-1/#comment-825</link>
		<dc:creator>blak3x</dc:creator>
		<pubDate>Thu, 10 Dec 2009 17:12:19 +0000</pubDate>
		<guid isPermaLink="false">http://www.gfi.com/blog/?p=1725#comment-825</guid>
		<description><![CDATA[Good post.  Though one should also mention that ideally not only letters (caps and not) and numbers should be used since brute force applications still find it relatively easy to crack them.  One should also use other special characters such as @#$ etc.]]></description>
		<content:encoded><![CDATA[<p>Good post.  Though one should also mention that ideally not only letters (caps and not) and numbers should be used since brute force applications still find it relatively easy to crack them.  One should also use other special characters such as @#$ etc.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

 Served from: www.gfi.com @ 2013-09-15 06:36:07 by W3 Total Cache --