How safe is my password?

[Deckerd]

I just use my name followed by 1234

 

[Rii]

. . . As a side note, my password is entirely secure becaue it uses fractional ASCII, so I can use letters halfway between 'A' and 'B' or 3/4ths 'D' mixed with 'C', or even irrational numbers like sqrt(2)*'F' + 'G'

I've never heard of such a thing. How do you do that?

*snicker*

 

[Asbo Zaprudder]

I always use control characters in passwords if the authentication system will accept them.

 

[Captain Ice]

I just use my name followed by 1234

Damn, that's the combination to my luggage.

 

[JarodRussell]

LOL, what the fuck. Did you guys really type in your password on some weird website? Are you nuts or what? Your password is now 100% not safe.

The site would have to have some way to personally identify you in order for the passwords to be useful.

One scenario: emails to company accounts about a site like this, and some idiot users follow it and blindly type in their passwords. A scammer can then try to hack the accounts since he now knows "100% save" passwords.

If you follow the link from here, the site knows that it had visitors from trekbbs.com. If trekbbs was of any worth, they could try to hack its user accounts since it's highly probable that people typed in their account passwords.

And if anything, it can serve to create better password crackers by feeding them with all those unusual combinations that they would never be able to crack otherwise.

 

[Rii]

 

[Amaris]

LOL, what the fuck. Did you guys really type in your password on some weird website? Are you nuts or what? Your password is now 100% not safe.

The site would have to have some way to personally identify you in order for the passwords to be useful.

One scenario: emails to company accounts about a site like this, and some idiot users follow it and blindly type in their passwords. A scammer can then try to hack the accounts since he now knows "100% save" passwords.

If you follow the link from here, the site knows that it had visitors from trekbbs.com. If trekbbs was of any worth, they could try to hack its user accounts since it's highly probable that people typed in their account passwords.

And if anything, it can serve to create better password crackers by feeding them with all those unusual combinations that they would never be able to crack otherwise.

There is no stored information, and the actual interface is client side. No browser data is submitted. It would be more likely that your toaster is reporting your password.

 

[Alidar Jarok]

My first important password: 2 hrs
My original password here: 2 hrs
My current facebook password: 163 Days
My current important password: 237 yrs
My current password here: 700 Million Years
My wifi network password: 39 Billion Years

At least my passwords have gotten stronger over time. There's something disturbing about the fact that my university password could be cracked in 2 hours.

 

[Lindley]

Apparently it's just based on the length of your password and (possibly) how many different types of characters it contains (not clear how that figures in). It doesn't even try a dictionary attack because that would require sending your password over the internet.

 

[Robert Maxwell]

The site would have to have some way to personally identify you in order for the passwords to be useful.

One scenario: emails to company accounts about a site like this, and some idiot users follow it and blindly type in their passwords. A scammer can then try to hack the accounts since he now knows "100% save" passwords.

If you follow the link from here, the site knows that it had visitors from trekbbs.com. If trekbbs was of any worth, they could try to hack its user accounts since it's highly probable that people typed in their account passwords.

And if anything, it can serve to create better password crackers by feeding them with all those unusual combinations that they would never be able to crack otherwise.

There is no stored information, and the actual interface is client side. No browser data is submitted. It would be more likely that your toaster is reporting your password.

Yeah, I was going to point that out next. I even looked at the code and it does not ever send the form contents up to the server, so there is no security risk here.

 

[Trekker4747]

 

[JarodRussell]

It doesn't even try a dictionary attack because that would require sending your password over the internet.

Which you do by typing it in the text field.

I'm just advocating some common sense here. This site may be harmless, but others aren't. And you'd find idiots who'd even type in their email addresses and other account data when they find such a site.

 

[Lindley]

It doesn't even try a dictionary attack because that would require sending your password over the internet.

Which you do by typing it in the text field.

Several people have told you otherwise; if you read the site, they suggest disconnecting your computer from the internet if you want. I tried it. Still worked. The computation is completely client-side, the only thing you get from the internet is a JavaScript app.

I'm just advocating some common sense here. This site may be harmless, but others aren't. And you'd find idiots who'd even type in their email addresses and other account data when they find such a site.

That much is true. You definitely want to investigate these things carefully before blindly entering sensitive information into *any* website. Including one that looks familiar, because it's possible to spoof the look of well-know sites.

 

[JarodRussell]

It doesn't even try a dictionary attack because that would require sending your password over the internet.

Which you do by typing it in the text field.

Don't be dense. Several people have told you otherwise; if you read the site, they suggest disconnecting your computer from the internet if you want. I tried it. Still worked. The computation is completely client-side, the only thing you get from the internet is a JavaScript app.

I know that. The question is: did you really check that before you started typing your password?

 

[Robert Maxwell]

Which you do by typing it in the text field.

Several people have told you otherwise; if you read the site, they suggest disconnecting your computer from the internet if you want. I tried it. Still worked. The computation is completely client-side, the only thing you get from the internet is a JavaScript app.

I'm just advocating some common sense here. This site may be harmless, but others aren't. And you'd find idiots who'd even type in their email addresses and other account data when they find such a site.

That much is true. You definitely want to investigate these things carefully before blindly entering sensitive information into *any* website. Including one that looks familiar, because it's possible to spoof the look of well-know sites.

I know that. The question is: did you really check that before you started typing your password?

Well, I did, but you are correct that your average Internet user is too trusting and ignorant to bother--and wouldn't know how to check, anyway. That's why browsers have started to come with phishing filters and the like.

 

[Lindley]

Personally I just clicked on the prominent "Is this safe?" button and did as it suggested.

 

[Mr. Laser Beam]

<Laurence Olivier> Is it SAFE?

 

[TheBrew]

I just entered a different password with the same character and length qualities as one that I usually do.

Of course, the site is a bit useless since most systems are protected against brute force attacks anyways.

 

[Asbo Zaprudder]

This is the Javascript source for the guts of the algorithm:

---
// Calculations per second. Ten million is roughly the number a decent PC could manage uninhibited
var calculationsPerSecond = 10000000;

// Keep track of how many character sets are used
var possibleCharacters = 0;

// Lowercase
if (password.match(/[a-z]/)) { possibleCharacters += 26; }

// Uppercase
if (password.match(/[A-Z]/)) { possibleCharacters += 26; }

// Numbers
if (password.match(/\d+/)) { possibleCharacters += 10; }

// Symbols
if (password.match(/[!,@,#,$,%,^,&,*,?,_,~,-,(,)]/) ) {possibleCharacters += 13};

// Work out the number of possible combinations: possible characters to the power of the password length
var possibleCombinations = Math.pow(possibleCharacters, password.length);

// Divide the number of possible combinations by the calculations a PC can do per second
var computerTimeInSecs = possibleCombinations / calculationsPerSecond;
---

Not terribly sophisticated.

There are also a few lookup tables for commonly used passwords of different lengths, for example:

arrayOfPasswords[8] = ['firebird','password','12345678','steelers','mountain','computer','baseball',
'xxxxxxxx','football','qwertyui','jennifer','danielle','sunshine','starwars',
'whatever','nicholas','swimming','trustno1','midnight','princess','startrek',
'mercedes','superman','bigdaddy','maverick','einstein','dolphins','hardcore',
'redwings','cocacola','michelle','victoria','corvette','butthead','marlboro',
'srinivas','internet','redskins','11111111','access14','rush2112','scorpion',
'iloveyou','samantha','mistress'];

 

[Deckerd]

I liked the arrayofpasswords.

Although it didn't have my name and 1234.