The Members Forum

Over the past few years, companies have increasingly adopted considerably stronger password policies. Unfortunately, there's still ample confusion in how to strengthen password policies and to mitigate password-focused attacks. I found dozens of mistakes in various security portals' password-hacking whitepapers, seen respected security vendors recommending incorrect mitigations to conflated attacks, and took note of highly knowledgeable security teams operating on mistaken assumptions.

I understand the confusion: There are many different types of password attacks (and defenses) and so much incorrect information on the Internet. The following are a few myths about password security that often surprise even the most seasoned security admins.

For starters, many admins think that password information retrieved from locally stored Windows profiles can be used in pass-the-hash attacks. In reality, the password verifiers stored in local profiles are extremely resilient against cracking -- up to tens of thousands of times harder to crack than a normal password hashes. What's more, they can't be used in pass-the-hash attacks at all.

Another common misconception: Any Windows password up to 14 characters in length can be quickly cracked using rainbow tables and clouds of GPU-equipped, superfast computers. In fact, if the LAN Manager hash is disabled, even 10- to 12-character passwords are extremely tough to crack.

Most password enforcers think that complexity beats length when strengthening password policies. It only works that way in the classroom. In the real world, length will give you far more protection than complexity; though you may give users 64,000 different symbols to choose among for their password, most people use the same 40 or so characters.

PC World has the details HERE!