[ale] OT: Slightly, this affects all platforms and hit M$ hard.

[Michael H. Warfield]

On Fri, 2012-12-07 at 09:36 -0500, Scott Castaline wrote:
> Through a link on a dmcrypt-LUKS mail list post to a comment on /.
> which linked to the following:
> http://securityledger.com/new-25-gpu-monster-devours-passwords-in-seconds/

> What's it going to take to stay ahead, Passphrases that take 15+
> minutes to type?

Don't use static passwords?

Use hardened cryptographic keys and SSL certs for things like ssh and
secure web where possible.

Use smart cards where available.

Use two factor auth (Google Authenticator is free and is easy to install
on Linux) where you need both the password and the authenticator code
from the authenticator to log in or unlock.  I've been using Google
Authenticator on my tablet for months (and my smartphone before it) with
about a dozen accounts in it.  Supports both time based OATH One Time
Password (TOTP) and hash based OATH One Time Password (HOTP) and defined
in the IETF RFC's so it interoperators with other OATH implimentations.

> The comment at /. says that M$ LM is now obsolete. No surprise there.

Regards,
Mike
-- 
Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw at WittsEnd.com
   /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 482 bytes
Desc: This is a digitally signed message part
URL: <http://mail.ale.org/pipermail/ale/attachments/20121207/98eb779f/attachment-0001.sig>