With regard to the passwords you use I'd like to show you a Web site.
Let's take a look at how secure is my password.
Dot net.
You can submit your password there and see if it's really secure.
If some of you actually provide your password to the form please review the earlier modules on modern
cyber threats and social engineering tricks by submitting a password to this site.
You give up your password and IP address to the computer that probably uses it to complete strangers.
Apart from this tiny detail note that some passwords guarantee no security at all.
Is non-secure passwords are the most popular combinations of characters.
That's why we use dictionaries to break into Wi-Fi networks and the previous modules.
Let's try to enter a different password.
It takes a second for a standard PC to crack the string.
Thomas
adding one to the end is an improvement by also adding an exclamation point.
You can get a pretty good result.
This is about password entropy.
About the randomness of a password the more entropy your password has the better it is.
Entropy is measured in bits a good strength is about 80 bits.
Let's try to think of a password that doesn't form any known string.
For example Q A's z x s w as you can see we've been beat to this idea this password represents a keyboard
layout.
The site is well worth visiting.
Not to check your actual password but to check some ideas for passwords that you can use.
Let's verify first if a strong password is enough to provide adequate security before we had a smartcard
authentication factor.
Passwords are the only security used for identifying users in a system.
If someone obtains our password they will be indistinguishable from us in the system they will be able
to send out emails or post messages on the Internet in our name and browse through our data we can make
a password relatively secure.
The above slide shows a standard windows log in screen not all people know though that the password
length is not restricted to any length in the form.
The form will accommodate longer passwords.
You don't have to limit password length to fit in.
It's difficult to think of a word that contains 16 to 18 letters but you can provide passwords that
are phrase based passphrases they'll be easier to remember and more secure.
Let's now review protocols and services used for authentication.
The mechanisms allow window systems to verify if a password or a passphrase is accurate.
The first aspect that is worth remembering is that Windows doesn't save user passwords in any way.
The system doesn't know your password it doesn't need to know it.
Authentication isn't about the system knowing a password.
It's about being able to check if the submitted password is correct.
These are two completely different things.
To verify if a correct string has been entered It's enough to compare the signature of the provided
string against the signature of the last updated string.
When those stores password signatures not passwords What are these signatures.
Older Windows systems including Windows XP store and protocol passwords
the passwords are referred to as Landman hashes.
We'll explain why it's not quite the same thing soon.
All new or relatively new Windows systems.
When those nine exes are excluded even if updated systems can also support this feature store passwords
in an anti LAN Manager hash format these hashes are commonly known as Unicode hashes.
The third type of credentials stored by operating systems is cached credentials.
You've probably noticed that if you connect to a network share or a server you will not have to provide
a password with subsequent connections.
The credential has been cached in some way.
We'll return to this later as well.