3 ms·

all the 50,000 words will not be chosen with the same probability. I think we are more like a random 8 characters [a-zA-Z0-9] password.

• creshal 10y ago
  > all the 50,000 words will not be chosen with the same probability. Why?
  • reacweb 10y ago
    red hammer effect.
    • creshal 10y ago
      How does that affect /dev/random?
      • snowwrestler 10y ago
        The XKCD comic skips lightly over this by simply stating that the words were randomly chosen. But being truly random is actually hard for most people to do off the tops of their heads. I doubt many people are taking away from that comic that they should use software to reliably randomly choose the words they memorize. Instead the advice seems to usually get shrunk down to "choose 4 random words," i.e. out of your own head. Most people don't carry 50,000 word dictionaries around in their heads. More like a few thousand. That changes the math considerably.
• peterbonney 10y ago
  This is my major concern with the "4 random word" approach: password crackers are extremely clever, and there may be non-obvious heuristics they can use to reduce the size of the search space. E.g. if we aren't totally committed to the method and we generate a few 4-word combos until we find one that we think is "memorable", that introduces an obvious bias that can probably be exploited. (For the record I do use the "4 random word" method for some passwords I want to be able to remember without having to open up my password manager. But I have nagging doubts about its security vs. random strings.)