Speaking of XKCD
Speaking of XKCD
Yep D
Consider that with most people you can also save the money for the drugs and the $ 5 for the wrench, telling them in an appropriate tone "IF you don't give me the password I WILL hit you with a wrench" is enough. wink
jaclaz
Well I said I'd get back with results from my rather crude test.
Just to re-state, I created 2 Word 2010 documents, one with password "Abcc" and the other with password "Abccd"
My setup is a dual core Intel P8600 runnig 2.4Ghz, 8GB RAM with Win7 Enterprise, with PRTK 6. Abcc took 10 hours to crack, Abccd was still trying nearly 4 weeks later and PRTK hung
Vendor setup is considerably more powerful with more RAM, more cores, and hardware acceleration with Passware. Abcc took 2 hours, Abccd was still trying 11 days later so they cancelled
We were just trying brute force attacks
Conclusion? Mine is that an 8-character (upper amnd lower case, no more compliacted than that)password created in an Office 2007 or later document will thwart casual/opportunistic attempts. That's all we were trying to establish
Cheers
Just to re-state, I created 2 Word 2010 documents, one with password "Abcc" and the other with password "Abccd"
Yep ) but that is "a tadbit" narrowing the topic.
I mean we started with "generic" strength of a password, we are now gone to "specific" Word2010 .docx format and very specific to the PRTK "cracking" tool, and even more specifically with this running on a - no offence whatever intended - comparatively low power hardware.
It is very possible that other vendors solutions (or even the same one ) particularly if run on a "dedicated" hardware making use of GPU(s) and/or using some form of parallelism will be able to get at your 8 characters password in a "reasonable" amount of time.
The graph data on this site
http//
sets the ratio for single GPU usage compared to a an Intel Core2 Quad CPY @2.66 GHz (i.e. already in theory much faster than your setup)
for Office 2010 @20000/370=54x
for Office 2013 @1360/40=34x
This should mean roughly that you ten hours for Abcc become more like 10 minutes. 😯
The "several weeks" may become days.
But the conclusion
Conclusion? Mine is that an 8-character (upper amnd lower case, no more compliacted than that)password created in an Office 2007 or later document will thwart casual/opportunistic attempts.
sounds perfectly "logic" D and provides a good "practical" reference, very, very useful.
jaclaz
risk is managed, rarely eliminated, and when you are balancing security, the real world is full of trade-offs. defence in depth is always a good idea, rather than reliance upon a single element. I'd strongly recommend moving towards two-factor authentication but also consider that a good password management system should be backed up with a solid audit and response process.
a tad (un)related - interesting little opinion piece by bruce schneier - http//
quite fascinating to consider 35,000 people and $11 *billion* spent annually on developing ways to enhance but also compromise digital defences. $11bn will buy you a seriously big wrench -)
Regards, Ross