RE: [libreoffice-users] Re: how to crack a PW in LO?

Oh, why is (7) considered Good News, below?

Well, it takes 45*365+197 > 16,500 cooperating culprits to crack a 7-character random password in 1 
day.

If that seems too feasible (it might be), try a challenging length, like 16 characters.  Just 
remember the Worse News, (8) in my previous message.

At some point, it is necessary to abandon passwords as reliable for protecting the privacy of 
encrypted documents.  All they do is increase the risk that an ordinary user will lose a password 
and not be able to open one of their own private documents.

 - Dennis


-----Original Message-----
From: Dennis E. Hamilton [mailto:dennis.hamilton@acm.org] 
Sent: Saturday, October 20, 2012 13:15
To: 'Sandy Harris'; users@global.libreoffice.org
Subject: RE: [libreoffice-users] Re: how to crack a PW in LO?

[ ... ]

 6. GOOD NEWS #1 (for now): Even allowing for (4-5), the estimates for longer passwords are 
heartening:

       Pwd   Accent OFFICE
    Length   Time Estimate (same conditions)
        <5   27m03s
        <6   1d19h
        <7   173d3h
        <8   45y197d

    You can see why length and random selection from the full 95 ASCII codes matters.  Using larger 
character sets is even better, of course.  I routinely use 15-character randomly-chosen passwords 
that are never used for more than one purpose.

 7. GOOD NEWS #2 (for now): It is possible to crowd-source this work on multiple processors or as a 
challenge with multiple hackers over the internet, where the attack space is subdivided.  Normally, 
one would not want to share the document, especially if its decryption is extremely valuable.  
However, there are parts of encrypted ODF documents that are benign and usable in a 
community/cloud-based attack. Once the password is recovered for that portion, the holder of the 
complete document can decrypt all of it.

[ ... ]


-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted