| | | Password length. . .
For maximum security with Windows, passwords should be 15 characters, or longer. It's the way Windows stores passwords internally -- splitting them into two 7 character pieces that's the problem. These shorter pieces can be revealed by cracking tools quite quickly.
This paragraph, taken from the longer article, explains -
But things are different with newer versions of Windows. Windows 2000 and XP passwords can now be up to 127 characters in length and so 14 characters is no longer a limit. Furthermore, one little known fact discovered by Urity of SecurityFriday.com is that if a password is fifteen characters or longer, Windows does not even store the LanMan hash correctly. This actually protects you from brute-force attacks against the weak algorithm used in those hashes. If your password is 15 characters or longer, Windows stores the constant AAD3B435B51404EEAAD3B435B51404EE as your LM hash, which is equivalent to a null password. And since your password is obviously not null, attempts to crack that hash will fail.
From symantec.com
Cheers, PW. |
|
