>> In our next section,
let's talk a little bit about passwords.
But before we go into some of the security concerns,
I just want to address one thing.
We were wrong about passwords and
it's time that we accepted that and move forward.
The National Institute of Standards and
Technology, or NIST,
previously provided guidance on how to create
strong passwords that they now say was wrong.
They used to recommend that people
create complex passwords
of at least eight alphanumeric characters,
including upper and lowercase letters
and special characters.
They also said to change passwords every 60 days.
Well, it turns out that we've made passwords
easier for an attacker to compromise,
but harder for us to remember.
For example, if we require you to
have an uppercase character in your password,
where are you likely to put it?
At the beginning. Hackers know this.
Then if we require you to have a number,
where is the number going to go?
At the end. Which number do
>> you likely use? The number 1.
>> These things became predictable to an attacker.
Complexity does not equal security.
The bottom line is that NIST,
has a new recommendation.
That is to string 4-5 random words
together to create a password.
Since it's long, it's harder for attackers to crack,
but it's easier for us to remember.
Since you have a stronger password,
NIST says not to change passwords
every 60 days unless there has been a compromise.
What makes passwords difficult
>> to crack is the number of
>> characters rather than the other tricks
that we've used in the past.
Now, there are lots of
different types of attacks on passwords.
Dictionary attacks try every character combination
in the dictionary file the attacker is using.
But they also add common passwords like P@sign SS,
W0, RD, and so forth.
Some of those dictionary files have
started to add common phrases as well.
That's why it's better to take for
random words rather than
a common phrase like to be or
not to be or something like that.
Now, brute force attacks
involve trying every combination of characters.
That's why using special
characters doesn't really help you.
The hybrid attack is a combination
between dictionary and brute force.
Birthday attacks, rainbow tables,
and pass the hash are all
>> based on the idea that if I can
>> generate the hash or
the value that represents your password,
then I can gain access and get authorization.
This will make more sense when we
talk about cryptography.
A replay attack just means that I'm able to
capture something on the
>> network and retransmit it later.
>> We keep this in mind because even if
your password is encrypted, it may not matter.
The bottom line is that if a replay attack can happen,
and it doesn't matter that your password is encrypted.
With passwords today, we've got to be aware of the fact
that we need to make them longer
and less difficult to remember.
We got to get with the times,
have better password policies and protect them better.