FlyerTalk Forums - View Single Post - Try to get IHG to Change from PIN to Passwords!
Old Aug 20, 2016 | 12:56 pm
  #10  
scubaccr
10 Years on Site
 
Join Date: Sep 2012
Location: Amsterdam, Asia, UK
Programs: IHG RA (Spire), HH Diamond, MR Platinum, SQ Gold, KLM Gold, BAEC Gold
Posts: 5,072
Originally Posted by FonzieBone

Here is a real password with 305 bits of complexity:
N4SFMs"D=(\CR3\b~^=}!GO9/}LTo0`*7!TVP+#'.'X3h0B'(t
Except no one bar a world memory championship contenders can remember such a random string as suggested above, and others are forced to write password above down And carry it around with them, negating the point of choosing such combo in the first place.
Added to fact if using another computer+keyboard, with non-US/non-En keyboard may leave you unable to login as character such as { needed could be missing/unavailable.

Yes 8char passwords or even 6char work where user account is revoked and locked after nn failed attemps (locked on 4th failure is fairly usual) are fairly secure if not guessable by knowing that userids user
BUT
where no userid revocation is performed, then hacking is not being prevented and is going to happen if you are targetted

Computing power has increased to such a degree that unlike 10years ago, longer passwords , where each extra alpha-numeric character increased password numbers by 62x (A-Z, a-z, 0-9 as else someone will say, wrong only 36x) are needed and mandatory internally in businesses. Italy even passed a law in the 2000's about password length required, which forced global multinationals to enforce that minimum on all their employees.
1chars = 62x
2chars = 3,844x
3chars = 238,328x
4chars = 14,776,336 x
5chars = 916 million x
6chars = 57,000 million x

Forcing options to include on occurence of 5-6 special characters in passwords, eg £$*&@# is not really changing above maths to prevent brute force hacking, and is really included in ones passwords to prevent dictionary attacks working

(eg A-Z, a-z, 0-9, £$*&@#)
1chars = 68x
2chars = 4,624x
3chars = 314,432x
4chars = 21,381,376 x
5chars = 1453 million x
6chars = 99,000 million x

So from above you can see going from 8char password to 12char password increases number of combinations by 21 Million, so to hack with brute force starting at eg aaaaaaaaaaaa takes an exponenentially increasing time and either takes 21,000,000 times as long or 21,000,000 times the computing power.

Home computers are far far faster than 10years ago, but can't increase in processing speed by factor of 1000 every year, so increasing password length and not using words works well.

Last edited by scubaccr; Aug 20, 2016 at 1:04 pm
scubaccr is offline