This says to try every possible alpha-numeric combination from 8 to 16 characters. This will take a very, very, very long time. RECOMMENDATIONS Any important password should be long enough and complex enough to prevent both standard dictionary attacks and “brute-force attacks” in which clusters of powerful computers work in parallel to test every possible character combination. (We recommend 12 or more completely random characters or a passphrase that contains five or more relatively uncommon words.) The key should not contain common “phrases,” expecially from well known literature like Shakespeare or religious texts, but also should not include number sequences or phrases, especially if they are related to the organization, its employees or its work. Specifically for wireless passwords, choosing a strong WPA key is one of the most ild not mportant steps toward defending an organization’s network perimeter from an adversary with the ability to spend some time in the vicinity of the offices. By extension, mitigating this vulnerability is critical to the protection of employees and partners (and confidential data) from the sort of persistent exposure that eventually brings down even the most well-secured information systems. Because shared keys inevitably end up being written on whiteboards, given to office visitors and emailed to partners, the WPA key should also be changed periodically. This does not have to happen frequently, but anything less than three or four times per year may be unsafe. Material that may be Useful: Sample Practice For practice on any of these methods, you can use the wpaInduction.pcap file from Wireshark. Resources https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html http://zed0.co.uk/crossword/ http://www.instantcheckmate.com/crimewire/is-your-password-really-protectingyou/#lightbox/0/ Page 85 of 240