Myth: if it is encrypted, it is secure Truth: if it is not encrypted, it is not secure A good password is one that's hard to guess, yet easy to remember. So here are the top 10 ways to choose a password, in roughly increasing difficulty. If you don't use any of the first 5, you're well on your way. The stats are very rough estimates (for comparison purposes, an 8-character password is used for most calculations): Default (same as none): Many programs and services assign a default password . Change this to a new password immediately. examples: password, superuser 10 Common passwords: god, love, lust, money, private, qwerty, secret, sex, snoopy, & (surprise!) password Personal info: your name, initials, location (zip code), birthday, pets, license plate family/friend's names (including maiden), locations, birthdays, pets word/number combinations of any of the above Ego-related; examples: guru, master, wizard Favorite: Music (group names, albums), Fiction/Nonfiction/Comic books/characters, Movie/TV/Cartoon characters & titles Dumb Hollywood movie-people think all passwords are of this variety Categories: Double-words; examples: kittykitty, johnjohn Funny/nonsense/jargon words; examples: wassup, bzzzzz, foobar Insults; examples: biteme, eatdirt Keyboard sequences; examples: asdfg, qweasd, poiqwe Obscene words; examples: (use your imagination) Passwords based on host name (for people with lots of passwords) for example, if the system is named 'cat' an obvious password is catpass Reversals; examples: terces, wordpass, nhojnhoj Dictionary & Foreign Language words: If you can find your word here, it's not a very good password. Common Passwords - Various Languages Dan Klein - Browsable and categorized lists of English words DEC Collection - compressed lists of common English words stats: There's 200,000+ words in the English language (most people use around 10,000-40,000). As a guesstimate, there's some 32,000 8-letter words/phrases. For some word lists, see The Electronic Alveary Mixed-Case Dictionary Words (alternating UPPER-lower case letters) examples: paSSworD, PLaceBO stats: If a word has 2 letters, there's 4 (22) ways to capitalize it (at, At, aT, AT). If a word has 8 letters, there's 256 ways. Similar combinations (2letters) apply to each word in the dictionary. Guesstimate: There's around 32,000 8-letter words, which gives 8 million (32,000 x 256) mixed-case 8-letter passwords Mixed-case Word with Number(s) examples: 9fiNgeRS, loVELy68 stats: Tacking on a number from 0-9 before or after a word gives 20 more variations to the password. Using 00-99 before or after the word, gives 200 variations. Guesstimate: there's some 19,000 6-letter words, and 243 million variations (19,000 x 64 x 200) of 6-letter-word 2-number passwords. Mixed-case Word(s)/Letter(s) Combining words and/or extra letters examples: GUessTHis, BiKeFisH stats: We're talking pretty big numbers here. Around 53 trillion (528) 8-letter mixed-case passwords (i.e. aaaaaaaa, aaaaaaaA, aaaaaaAa, ..., ZZZZZZZZ) Mixed-case Words/Numbers/Letters examples: No50WaY2, puT863MoX variant: Hacker/IRC/License-plate jargon examples: H4x0rD00dZ, UR2good4Me, FXR1stR8 stats: OK, my mind's swimming, there's somewhere around 218 trillion (628) 8-letter/number passwords It takes an average of 5 seconds to crack this kind of password on a Windows machine; considerably longer on BSD or Linux. Random characters examples: qs3UIs82, k38#0J$dA note: some programs and services only allow letters and numbers, some include dashes ('-'); the best allow any character stats: Assuming 94 'type-able' characters, there's 6 gazillion (948 = 6.1 quadrillion [US]) different 8-character passwords. There's not as many 7-character passwords, but there's some 9-character ones still available, if you hurry. In general: No password is uncrackable. The best you can do is make it difficult and non-trivial to determine your password. What's the worst password? The one you've forgotten. Whatever method you choose, it's a good idea to change your password often. The more important the password, the more often it should be changed. Why? If someone is attempting a brute-force attack on your password, the hope is that you're changing it to something they've already tried and found to be wrong. The longer the password, the harder it is to 'guess.' note: many systems limit passwords to 8 characters. Some clever people are foregoing brute-force hacks (e.g. dictionary attacks), in favor of 'social engineering' to obtain passwords. If somebody calls or emails, requesting your password, it's a dumb idea to give it to them. Of course nobody would sticky-note a password to their monitor, or under a keyboard. Find out how your password rates according to the above standards. This is a measure of the difficulty hackers/crackers will have in 'guessing' your password. Enter your password below, and get an approval rating. Password: Note: Do NOT just press your Enter key, you must use (click) the button: Related info: Encryptions, passwords and cryptography: MIT's guide to password choosing Counterpane Diceware passphrase method Security & Human Factors Visual passwords The Hack FAQ: Unix Passwords Handbook of Applied Cryptography (PDF format) The Redbook Web Informant Applications (software): Check password composition: Npassword (Unix, Linux, BSD) PassFilt (WinNT) Encryption: OpenPGP - Open Source PGP, see also: GnuPG PGP.com - Pretty Good Privacy, created by Phil Zimmerman iButton - encryption for your key ring For the mathematically inclined: To brush up on your advanced math skills, see Calculus, Complex Variables, & Differential Equations GNU Scientific Library - ANSI C routines for numerical computing Other categorizations: An interesting study of 1100 Brits revealed the following password choices: Family (1/2): Family names, nicknames, pets Fans (1/3): Fans: sports teams, pop stars, cartoons Ego (1/9): fawning descriptions of oneself Cryptics (1/11): see 6-10 above Credits: Special thanks to Adrik L. for pointing out a flaw in the password checker. Copywrite © Usewise
Strange stuff.. Well most of Lithuanians use this password: lopas or lopass or lopasss or lopassss or lopasssss and that goes up and up
Pretty well Spam / Flame Gtfo if u wanna be like this it tells u how u can protect ur pass i guess I threw this up because for Ages ppl been asking for a list of common pases and there ay go
Or you could always just give them a RAT, and arp poison + packet sniff. That would be more effective than brute forcing them by a long shot.
