3 ms·

Usability is key. Once you hit 12+ characters it is extremely likely that the password is vulnerable to dictionary/phrase attacks combining whole words - or yo

by Ntrails 11y ago

Usability is key. Once you hit 12+ characters it is extremely likely that the password is vulnerable to dictionary/phrase attacks combining whole words - or you're using a password manager. The xkcd is funny - but it's also a terrible password suggestion.

Retric 11y ago
Nothing is wrong with a good password manager. Don't forget having lot's of passwords written down in an office setting is terrible for different reasons. &$RGJL__"LKHF#3fghu seems great until it's an a sticky or notepad file.
- JoeAltmaier 11y ago
  I just wish the managers would really manage. Instead of just being a sticky-note substitute, if they'd take passwords out of my way (by automatically providing them when needed, once I'm authenticated to the password manager).
_kst_ 11y ago
Why is it terrible? Certainly a passphrase consisting of 4 English words is going to be easier to attack than a password consisting of a similar number of random letters. But as long as you judge a password or passphrase by its information content rather than by its length, xkcd-style passphrases can be just as good as random letters, but are likely to be easier to remember. Plug: I've written a random passphrase generator, inspired by xkcd's https://xkcd.com/936/ https://xkcd.com/936/ ("correct horse battery staple") that picks random words from a dictionary, subject to requirements you can give on the command line. It optionally tells you how much randomness is contained in the generated passphrase (assuming the attacker knows the parameters you used). Sample output (picking 4 words of 6 to 8 letters): $ gen-passphrase -v 4 6 8 verity nonfat shunted specking 27405**4 5.6405e17 possibilities, equivalent to: 58.97 random bits 12.55 random lowercase letters 9.90 random mixed-case alphanumerics 9.00 random printable ASCII characters The reported numbers will vary depending on which dictionary you use (/usr/share/dict/words by default). In this case, the dictionary contained 27405 words of 6 to 8 letters. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords Of course this won't work for sites that restrict the length of a password, or that require special characters.
- carussell 11y ago
  > Why is it terrible? Ars Technica published an article a few years ago about password crackers, and one of the subjects they interviewed mentioned the XKCD strip in an offhand remark that was flawed and hinted towards what was probably a poor understanding of the subject matter. Now whenever the XKCD strip is brought up, people who've been shown the article make an appearance and and talk about the scheme being vulnerable while using the phrase "dictionary attack" in a non-specific sort of way. That's probably what's going on in the GP comment. http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ http://arstechnica.com/security/2013/05/how-crackers-make-mi...
deleted 11y ago
[deleted]

by Ntrails 11y ago

Retric 11y ago

Nothing is wrong with a good password manager. Don't forget having lot's of passwords written down in an office setting is terrible for different reasons. &$RGJL__"LKHF#3fghu seems great until it's an a sticky or notepad file.

JoeAltmaier 11y ago
I just wish the managers would really manage. Instead of just being a sticky-note substitute, if they'd take passwords out of my way (by automatically providing them when needed, once I'm authenticated to the password manager).

_kst_ 11y ago

Why is it terrible? Certainly a passphrase consisting of 4 English words is going to be easier to attack than a password consisting of a similar number of random letters. But as long as you judge a password or passphrase by its information content rather than by its length, xkcd-style passphrases can be just as good as random letters, but are likely to be easier to remember. Plug: I've written a random passphrase generator, inspired by xkcd's https://xkcd.com/936/ https://xkcd.com/936/ ("correct horse battery staple") that picks random words from a dictionary, subject to requirements you can give on the command line. It optionally tells you how much randomness is contained in the generated passphrase (assuming the attacker knows the parameters you used). Sample output (picking 4 words of 6 to 8 letters): $ gen-passphrase -v 4 6 8 verity nonfat shunted specking 27405**4 5.6405e17 possibilities, equivalent to: 58.97 random bits 12.55 random lowercase letters 9.90 random mixed-case alphanumerics 9.00 random printable ASCII characters The reported numbers will vary depending on which dictionary you use (/usr/share/dict/words by default). In this case, the dictionary contained 27405 words of 6 to 8 letters. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords Of course this won't work for sites that restrict the length of a password, or that require special characters.

carussell 11y ago
> Why is it terrible? Ars Technica published an article a few years ago about password crackers, and one of the subjects they interviewed mentioned the XKCD strip in an offhand remark that was flawed and hinted towards what was probably a poor understanding of the subject matter. Now whenever the XKCD strip is brought up, people who've been shown the article make an appearance and and talk about the scheme being vulnerable while using the phrase "dictionary attack" in a non-specific sort of way. That's probably what's going on in the GP comment. http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ http://arstechnica.com/security/2013/05/how-crackers-make-mi...

deleted 11y ago

[deleted]