RE: Re: RE: ADS Password Storage Protection

["Pranav Lal" <pranav.lal () gmail com>]

Hi all,

Since we are discussing passwords, has anyone tried dice where?
http://www.diceware.com

Pranav 

-----Original Message-----
From: eric.baechle () dhs gov [mailto:eric.baechle () dhs gov] 
Sent: Tuesday, July 18, 2006 1:25 AM
To: security-basics () securityfocus com
Subject: Re: Re: RE: ADS Password Storage Protection

Winshel;


Actually, a passphrase is not as secure as a random password.  As you
probably have heard, "Don't use dictionary words" over and over again.  Even
compound dictionary words are bad, ie: "firedogdalmation".  Compounding
dictionary words with spaces, punctuation, and even gramatically correct
modifiers in between is really no different than without.  It's a very
simple substitution to try; "firedogdalmation" and then try "fire dog
dalmation", "Fire Dog Dalmation", "Dalmation the Fire Dog", etc.


Using compound dictionary words could come back to bite you very quickly,
even when used in long phrases.


Sincerely,


Eric Baechle, CISSP/ISSEP, etc.

Senior INFOSEC/OPSEC Engineer

Department of Homeland Security

---------------------------------------------------------------------------
This list is sponsored by: SensePost

Hacking, like any art, will take years of dedicated study and  
practice to master. We can't teach you to hack. But we can teach you  
what we've learned so far. Our courses are honest, real, technical  
and practical. SensePost willl be at Black Hat Vegas in July. To see  
what we're about, visit us at: 

http://www.sensepost.com/training.html
---------------------------------------------------------------------------


---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------