5 ms·

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable

That comic is unfortunately not telling the truth. The password phrase IS 44 bits of entropy, assuming you input random ascii. But any reasonably knowledgeable person trying to crack passwords, will use a dictionary to create a passphrases, rendering this less useful than the first password. Even if you do substitute o/0/ø, i/l/1, a/4, ect randomly. You still need a rather long sentence, and preferably spice it up with simple substitution - now this passphrase is no longer easy or simple to remember.

noja 10y ago
Then why doesn't he update it?
whiteandnerdy 10y ago
I think XKCD is correct here. If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 48log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attacker knows exactly what strategy we're using, so 44 bits is the better number to work with. Since that's still more than 28 bits, a 'correct horse battery staple' type password is harder to crack then a short random string of mixed characters, even if the attacker knows exactly what your password generation strategy is.
- whiteandnerdy 10y ago
  > I think XKCD is correct here. > If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 48log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attacker knows exactly what strategy we're using, so 44 bits is the better number to work with. > Since that's still more than 28 bits, a 'correct horse battery staple' type password is harder to crack then a short random string of mixed characters, even if the attacker knows exactly what your password generation strategy is. Typo in the above but can't edit on my phone, the second sum should be 4 \* 8 \* log_2(26). Apologies.
- hvidgaard 10y ago
  Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.
  - oneeyedpigeon 10y ago
    None of [ "correct", "horse", "battery", "staple" ] are in that 100 list, though.
  - croon 10y ago
    I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words https://github.com/dwyl/english-words
    - hvidgaard 10y ago
      There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.
      - rsanders 10y ago
        I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".
jejeuhds 10y ago
No, you are wrong. The number of bits of entropy in "horsestaple..." is estimated by assuming the words where chosen at random from the 2^11=2048 most common words. 4*11=44 bits in total. In practice it is even better since a hacker would also try different kinds of passwords! So no, you do not need substitute characters.
- hvidgaard 10y ago
  Yes, I was wrong about the entropy when writing that. But I still don't think that passphrases are as godsend as the comic make it seem. Can we really assume 2048 common words? The 100 most commonly used, make up 50% of written words. A common sentence like "I drove to the mall yesterday" is not a good passphrase, but I'm certain that people who use "rocket" as a password would do something similar.
  - Symbiote 10y ago
    The intention is that the random words are selected from a list of 2000 unique, common words. Choosing a sentence is a different strategy, which is less secure. $ wget -O ⅓Mwords http://norvig.com/ngrams/count_1w.txt $ for i in `seq 10`; awk '/^[a-z]{3,}/ { print $1 }' ⅓Mwords | head -n 2000 | shuf -n 5 | tr '\n' ' ' && echo videos possible disease maintenance chair teen documents than without son research interface library largest drive location ball beauty coming files files middle fri meet air guarantee samsung click super inn legal previous rent resort use reply thought better fresh phentermine bad command once vehicle australian fun random professor course sponsored
    - hvidgaard 10y ago
      A random 5 words is hardly simple or easy to remember. The entire selling point of passphrases is exactly that. It's a hard problem that is IMO best solved with hardware secure keeping of secrets and a rate limited pincode.
      - croon 10y ago
ketzu 10y ago
I think you failed to think that through. Random alphanumeric input of that length would be 25log(36)=525=125 bits. It is 11 bits per word because it is chosen from a ~2000 words dictionary. Edit: should have reloaded, said by enough people already :D

noja 10y ago

Then why doesn't he update it?

whiteandnerdy 10y ago

I think XKCD is correct here. If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 48log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attacker knows exactly what strategy we're using, so 44 bits is the better number to work with. Since that's still more than 28 bits, a 'correct horse battery staple' type password is harder to crack then a short random string of mixed characters, even if the attacker knows exactly what your password generation strategy is.

whiteandnerdy 10y ago
> I think XKCD is correct here. > If you choose four random words from a list of 2048 common words, and your attacker knows that's what you're doing, then your entropy is 4 * log_2(2048) = 44 bits. If the attacker didn't know your strategy and tried to brute force letter by letter it would be much higher - around 48log_2(26)=150 bits assuming around eight letters per word - but like you said, we should assume the attacker knows exactly what strategy we're using, so 44 bits is the better number to work with. > Since that's still more than 28 bits, a 'correct horse battery staple' type password is harder to crack then a short random string of mixed characters, even if the attacker knows exactly what your password generation strategy is. Typo in the above but can't edit on my phone, the second sum should be 4 \* 8 \* log_2(26). Apologies.
hvidgaard 10y ago
Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.
- oneeyedpigeon 10y ago
  None of [ "correct", "horse", "battery", "staple" ] are in that 100 list, though.
- croon 10y ago
  I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words https://github.com/dwyl/english-words
  - hvidgaard 10y ago
    There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.
    - rsanders 10y ago
      I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".

jejeuhds 10y ago

No, you are wrong. The number of bits of entropy in "horsestaple..." is estimated by assuming the words where chosen at random from the 2^11=2048 most common words. 4*11=44 bits in total. In practice it is even better since a hacker would also try different kinds of passwords! So no, you do not need substitute characters.

hvidgaard 10y ago
Yes, I was wrong about the entropy when writing that. But I still don't think that passphrases are as godsend as the comic make it seem. Can we really assume 2048 common words? The 100 most commonly used, make up 50% of written words. A common sentence like "I drove to the mall yesterday" is not a good passphrase, but I'm certain that people who use "rocket" as a password would do something similar.
- Symbiote 10y ago
  The intention is that the random words are selected from a list of 2000 unique, common words. Choosing a sentence is a different strategy, which is less secure. $ wget -O ⅓Mwords http://norvig.com/ngrams/count_1w.txt $ for i in `seq 10`; awk '/^[a-z]{3,}/ { print $1 }' ⅓Mwords | head -n 2000 | shuf -n 5 | tr '\n' ' ' && echo videos possible disease maintenance chair teen documents than without son research interface library largest drive location ball beauty coming files files middle fri meet air guarantee samsung click super inn legal previous rent resort use reply thought better fresh phentermine bad command once vehicle australian fun random professor course sponsored
  - hvidgaard 10y ago
    A random 5 words is hardly simple or easy to remember. The entire selling point of passphrases is exactly that. It's a hard problem that is IMO best solved with hardware secure keeping of secrets and a rate limited pincode.
    - croon 10y ago

ketzu 10y ago

I think you failed to think that through. Random alphanumeric input of that length would be 25log(36)=525=125 bits. It is 11 bits per word because it is chosen from a ~2000 words dictionary. Edit: should have reloaded, said by enough people already :D