<story><title>GoToMyPC has been hacked, all customer passwords reset</title><url>http://status.gotomypc.com/incidents/s2k8h1xhzn4k</url></story><parent_chain><item><author>voltagex_</author><text>Couldn&amp;#x27;t I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?</text></item><item><author>sandworm101</author><text>But if the trick you are using results in sufficient entropy, it shouldn&amp;#x27;t matter that the enemy has thought of it too.  I&amp;#x27;m still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. &amp;quot;Catrunningfishhostagelaptop&amp;quot; is a good password these days.  it is easily remember but also difficult to brute force even if you know the trick by which it was constructed.&lt;p&gt;(And yes, by putting it out there I realize it is now a bad password.)</text></item><item><author>hackuser</author><text>&amp;gt; This is not a good suggestion on their part, and has long been proven ineffective:&lt;p&gt;Agreed; that is bad advice.&lt;p&gt;I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g., AmeriKa), patterns on your keyboard, etc.&lt;p&gt;In a more technical sense, that applies to tricks that can be defeated with an algorithm and affordable computing resources.</text></item><item><author>magoon</author><text>This is not a good suggestion on their part, and has long been proven ineffective:&lt;p&gt;&lt;pre&gt;&lt;code&gt;   Substitute numbers for letters that 
   look similar (for example, substitute
   “0” for “o” or “3” for “E”.&lt;/code&gt;&lt;/pre&gt;</text></item></parent_chain><comment><author>zo1</author><text>The way to compute the amount of possible brute-force combinations:&lt;p&gt;For a normal 5 letter (alpha-numeric only) password:&lt;p&gt;36 factorial, which is (36 * 36 * 36 * 36 * 36) = 60 million possible combinations.&lt;p&gt;However, for a 5-word password, the calculation is as follows:&lt;p&gt;Assuming the number of possible words in the English language is 1.025109 million, then:&lt;p&gt;1,025,109 factorial, which is (1,025,109 * 1,025,109 * 1,025,109 * 1,025,109 * 1,025,109) = &lt;i&gt;A really big number&lt;/i&gt;.&lt;p&gt;So, granted, the amount of possible words is much smaller than that. But the attacker can&amp;#x27;t know that for sure. To put the number above in scale, just 69 factorial is equivalent to 1.711224524 * 10^98.</text></comment>
<story><title>GoToMyPC has been hacked, all customer passwords reset</title><url>http://status.gotomypc.com/incidents/s2k8h1xhzn4k</url></story><parent_chain><item><author>voltagex_</author><text>Couldn&amp;#x27;t I write a bruteforcer that instead of 5 * letters, tried 5 * dictionary words and get your password easily?</text></item><item><author>sandworm101</author><text>But if the trick you are using results in sufficient entropy, it shouldn&amp;#x27;t matter that the enemy has thought of it too.  I&amp;#x27;m still a fan of linking common words together as this results in easily-memorized passwords with very high entropy. &amp;quot;Catrunningfishhostagelaptop&amp;quot; is a good password these days.  it is easily remember but also difficult to brute force even if you know the trick by which it was constructed.&lt;p&gt;(And yes, by putting it out there I realize it is now a bad password.)</text></item><item><author>hackuser</author><text>&amp;gt; This is not a good suggestion on their part, and has long been proven ineffective:&lt;p&gt;Agreed; that is bad advice.&lt;p&gt;I tell people: If you think of a trick then the attackers, who have expertise and think about these issues all the time, have thought of it long ago and have written it into their password-cracking software. That applies to visual substitutions (such as GoToMyPC recommended), phonetic substitutions (e.g., AmeriKa), patterns on your keyboard, etc.&lt;p&gt;In a more technical sense, that applies to tricks that can be defeated with an algorithm and affordable computing resources.</text></item><item><author>magoon</author><text>This is not a good suggestion on their part, and has long been proven ineffective:&lt;p&gt;&lt;pre&gt;&lt;code&gt;   Substitute numbers for letters that 
   look similar (for example, substitute
   “0” for “o” or “3” for “E”.&lt;/code&gt;&lt;/pre&gt;</text></item></parent_chain><comment><author>DerfK</author><text>The question is whether people are all going to pull words from a very small pool or form sentences to cut the search space (adjective noun adverb verb noun).  A search space of 2000^5 (2000 most common words without punctuation) is still about 20 times larger than 80^8 (upper&amp;#x2F;lower&amp;#x2F;number&amp;#x2F;symbols)</text></comment>