In a lot of organizations we work with, something as simple as changing the password policy from a minimum length requirement of 8 to 14 is anything but simple. They have to get approval, organizational buy-in from top management, and then deal with hundreds of help desk tickets and frustrated employees once the change is […]
After performing penetration tests for a myriad of companies over the last decade, there is one thing that stands out above all others…. People suck at making passwords. At first I thought “how hard can it be?” But after working with company after company, and trying to improve their password security, I have realized that […]
In a previous blog, we covered the difference between an online and offline password attack. This blog will continue from there. Once a hacker is able to get your password hash offline for a password attack, let’s explore how a hacker guesses your password. As a point of clarification, this blog is written from the […]
The difference between a password and passphrase is simply a terminology change. A password is typically around 8 characters long and meets necessary complexity requirements. For example Panthers1! A passphrase, by contrast, is making your password into a sentence, including spaces and punctuation as necessary. An example of a passphrase is “I love the Carolina Panthers!” […]
