3 ms·

Two years ago I wrote about why this type of password is no longer safe: https://medium.com/@hnlean/imp3n3tr-ble5832-not-an-impenetrable-password-anymore-db9f4f

by hliyan 11y ago

Two years ago I wrote about why this type of password is no longer safe: https://medium.com/@hnlean/imp3n3tr-ble5832-not-an-impenetrable-password-anymore-db9f4fbff1ba https://medium.com/@hnlean/imp3n3tr-ble5832-not-an-impenetra... (See step #6 in the list of steps in the article) I'm sure the situation has only got worse since then.

archagon 11y ago
Xkcd was advocating diceware, not "making up a passphrase". If your pool of words is sufficiently large, your rolls are random, and you have enough rolls, your password should be as secure as a random number.
DanBC 11y ago
The point of a passphrase is to randomly generate each word in the phrase. Even Diceware, which uses a list of 7776 words, is resistant to attacks if you have a 7 word passphrase. You use your long random passphrase to protect your password safe. The passwords in your safe are long randomly generated strings of lower case, upper case, digits, and special chars. > But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. If the hacker is really obsessive about it, he will just keep the program running for weeks until a match is found. No one today recommends 4 word passphrases - 7 word is the minimum. But 4 words is probably better than most passwords that people use at the moment.
orless 11y ago
> But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. The xkcd comic suggests a combination of four from a very modest 2000 (2^11) common words resulting in ca. 2^44 combinations to check. It also assumes 100 guesses/sec which result in over 500 years to break. That's precise math and a somewhat reasonable assumption. You counter this with an argument like "the number of such combinations are very large, but it’s not impossible". You give no new numbers, no counter-assumptions, you don't argue that 100 guesses per second is too slow, you just state this. So in this form your argument is ungrounded.
- StavrosK 11y ago
  100 guesses/sec is really slow, though, when a desktop pc can do billions of SHA hashes a second.

by hliyan 11y ago

archagon 11y ago

Xkcd was advocating diceware, not "making up a passphrase". If your pool of words is sufficiently large, your rolls are random, and you have enough rolls, your password should be as secure as a random number.

DanBC 11y ago

The point of a passphrase is to randomly generate each word in the phrase. Even Diceware, which uses a list of 7776 words, is resistant to attacks if you have a 7 word passphrase. You use your long random passphrase to protect your password safe. The passwords in your safe are long randomly generated strings of lower case, upper case, digits, and special chars. > But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. If the hacker is really obsessive about it, he will just keep the program running for weeks until a match is found. No one today recommends 4 word passphrases - 7 word is the minimum. But 4 words is probably better than most passwords that people use at the moment.

orless 11y ago

> But you’re forgetting the massive GPU array. The hacker runs a program that generates random combinations of two, three or four dictionary words and tries it against your password hash. It’s going to take a while because the number of such combinations are very large, but it’s not impossible. The xkcd comic suggests a combination of four from a very modest 2000 (2^11) common words resulting in ca. 2^44 combinations to check. It also assumes 100 guesses/sec which result in over 500 years to break. That's precise math and a somewhat reasonable assumption. You counter this with an argument like "the number of such combinations are very large, but it’s not impossible". You give no new numbers, no counter-assumptions, you don't argue that 100 guesses per second is too slow, you just state this. So in this form your argument is ungrounded.

StavrosK 11y ago
100 guesses/sec is really slow, though, when a desktop pc can do billions of SHA hashes a second.