Unbelievable where this gov't is heading. Gonna be time to get off the grid sooner than later:

 

http://www.theblaze.com/stories/2013/07/26/report-feds-demand-major-internet-companies-turn-over-user-passwords/

 

 

 

REPORT: FEDS DEMAND MAJOR INTERNET COMPANIES TURN OVER USER PASSWORDS

 

Jul. 26, 2013 7:20am Jonathon M. Seidl

 

The federal government has demanded that major internet companies turn over users’ stored passwords, two sources told the respected tech website CNet.

 

So what exactly does this “escalation” — as CNet calls it — mean?

“If the government is able to determine a person’s password, which is typically stored in encrypted form, the credential could be used to log in to an account to peruse confidential correspondence or even impersonate the user,” the report says. “Obtaining it also would aid in deciphering encrypted devices in situations where passwords are reused.”

 

But it doesn’t end there. The government is not only requesting the passwords, but its also asking for algorithms and even security questions:

Some of the government orders demand not only a user’s password but also the encryption algorithm and the so-called salt, according to a person familiar with the requests. A salt is a random string of letters or numbers used to make it more difficult to reverse the encryption process and determine the original password. Other orders demand the secret question codes often associated with user accounts.

According to the report’s sources, the government has requested password information on numerous occasions. Still, both sources said the companies fight them.

 

“We push back,” one said.

 

“There’s a lot of ‘over my dead body,’” said another.

 

Most of the big internet companies — Microsoft, Google, and Yahoo — declined to comment or give any specific information regarding the allegations, but Yahoo did say, “”If we receive a request from law enforcement for a user’s password, we deny such requests on the grounds that they would allow overly broad access to our users’ private information. If we are required to provide information, we do so only in the strictest interpretation of what is required by law.”

 

Still, CNet does offer some hope for those who may be concerned about this new era of government surveillance: it’s not guaranteed that if the government gets a stored or encrypted password that they can crack it.

 

“Even if the National Security Agency or the FBI successfully obtains an encrypted password, salt, and details about the algorithm used, unearthing a user’s original password is hardly guaranteed,” the report says. “The odds of success depend in large part on two factors: the type of algorithm and the complexity of the password.”

 

There is some advice, though, buried deep in the report. Although the author doesn’t expressly say it, he does note that longer passwords that contain odd characters are much harder to crack — even with an algorithm:

One popular algorithm, used by Twitter and LinkedIn, is called bcrypt. A 2009 paper (

PDF

) by computer scientist 

Colin Percival

 estimated that it would cost a mere $4 to crack, in an average of one year, an 8-character bcrypt password composed only of letters. To do it in an average of one day, the hardware cost would jump to approximately $1,500.

But if a password of the same length included numbers, asterisks, punctuation marks, and other special characters, the cost-per-year leaps to $130,000. Increasing the length to any 10 characters, Percival estimated in 2009, brings the estimated cracking cost to a staggering $1.2 billion.

It almost makes you want to go back and read TheBlaze’s report on five ways to thwart the government from spying on you.

Read CNet’s full report for more.

My password is so dirty you will turn into a pillar of salt if you read it.

 

Start watching for statues of NSA and FBI agents showing up in unusual places.

 

 

This seems appropriate here:

 

I get pissed when a password can only be a short length...

This government is out of control..

Wait, my passwords like my name, or 'sex,' 'love,' 'God,' 'password,' and '12345' aren't good passwords?

 

though '1sex2love3God4password5' would probably make a pretty good one...

 

One of the problems with passwords is the term itself - 'password' to most people means a single word.  Maybe a few numbers, or for the more security-minded, some special characters.  Call it a 'pass phrase' and suddenly people realize it can be more than a word.  A sentence that is easy to remember and fast to type is way stronger than a single word and number, as the graphic above shows...  Most passwords will use one one of 72 characters.  People using characters on the keyboard expand that to 94.  Figure out how to use more of ASCII, and you could have as many as 256 possible characters. '±°²³ ' (plus/minus, degree, squared, cubed, null [not just a space]) are some I use regularly, though not in passwords since not all can be replicated on a phone or tablet.

 

Another problem is that people reuse their passwords...so if someone gets your email password, they likely will get access to any accounts they find out about from reading your emails...and if they can't get in using your password, they can always reset it using the email address they now control...

 

Something I hate is places not allowing use of special characters in your password, or limiting you to 8 characters or other similar nonsense.

 

All hail the glorious 57-character long password!!!1!one!