• 1 Post
  • 62 Comments
Joined 2 years ago
Cake day: July 20th, 2023
  • SpikesOtherDog@ani.socialtoSelfhosted@lemmy.world•Proxmox somehow just dies during rsyncEnglish
    2·
    22 days ago

    True, but it’s not clear to me that both drives are exhibiting the behavior and it sounds more like a copy between two drives. I wouldn’t rule it out and do think it is a possibility, but in my professional experience drives fail much more frequently than controllers.

    It makes sense to me to test the drives individually, in another system preferably, using smart long test, which is non-destructive. Next test other drives in this system. If there are errors, try changing out the SATA cables, too. If you can shuffle the data off the drives, do so and then try running them through a secure erase in another system. A bad drive should fail the same way in another system.

    My other thought for probably not being the controller is that 4TB is a very long time for a sustained transfer to fail on a flakey component. Also, there are no reports of other errors.

  • SpikesOtherDog@ani.socialtoToday I Learned@lemmy.world•TIL that if you search "Password generator, [x] characters, [y] strength" at DuckDuckGo, it will generate a password for you.English
    1·
    3 months ago

    So, the difference with no numbers and special characters is 52^20 (2x10^34) versus 95^20 (3.6x10^39). There are three reasons this runs into issues.

    Pure math indicates that a 20 digit alpha only password with caps sprinkled in is slightly stronger than 12-13 digits of alphanumeric plus caps and specials.

    Out of the various people within various organizations I have supported, people have disclosed their passwords to me a breathtaking number of times. It is quite common for people to create a password with only lower characters. That would be 4x10^27, about the same as 14 characters using the full qwerty set.

    Either way, we are discussing a password cracking tool running locally attempting to hash your password. You do have a point that 12 thousand years is a very long time to arbitrarily guess a password. Unless something changes where someone can easily access ten thousand cores at a reasonable utility, you are pretty much safe from anyone except state level threats. That would be full time use of that many cores for 37 days at 10k cores, or 9 hours access to a million cores. We just aren’t there yet. No clue if this would work better with GPU time, but that would still be a serious system.

    Now, I am stepping into old lessons from 2011, and I can’t find a great source to back myself up. If I’m wrong, then I have been operating off this misinformation for 15 years and I’d gladly appreciate better information.

    The final issue is that since passwords are hashed in chunks, parts of the password could become visible while the rest is being worked on. This could lead to the attacker guessing the rest of the password.

  • SpikesOtherDog@ani.socialtoToday I Learned@lemmy.world•TIL that if you search "Password generator, [x] characters, [y] strength" at DuckDuckGo, it will generate a password for you.English
    1·
    3 months ago

    I want to be clear that what I’m about to say only refers to compromised systems where the password database has already been exfiltrated and systems that do not lock or otherwise slow down attackers.

    A system where the passwords are inaccessible, requires periodic password changes, enforces complexity, and locks out invalid attempts probably is fine, but I’ll get there.

    A password cracking tool will typically start with lists of known passwords, then it will move on to dictionary words. If the attacker has any personal information, and the means to add it, they will give priority to that information. Phrases with multiple words are more likely, and will be tested next. These dictionary attacks are run first because on a fast enough system they can crack a password in weeks. Munging standard spelling increases the entropy here, increasing the number of attempts to guess a password.

    From here, an attacker must start brute force, which tries to decipher your password one character at a time. Adding uppercase characters doubles the number of characters, but that is still super quick to crack. Adding numbers begins to increase the time, but all this is going to be checked within hours or days depending on the length of the password and the resources the attacker is committing.

    Adding special characters significantly increases the amount of time because just the standard (33?) characters characters easily accessible on a common US Qwerty keyboard multiples the checks that many times, per each character in the password.

    So, uncommonly misspelled words and sprinkled in characters increase the security of your accounts over just dictionary words. This would guard a person’s reputation at work if anyone got their company’s AD password file out without notice, as well as one’s security if their browser’s password store is compromised. Also, some people refuse to follow proper security for convenience, and it is sometimes possible to find a service that will allow rapid password attempts.