6 ms·

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKC

by mrob 9y ago

>if you can remember your password, its probably too weak As XKCD famously pointed out[0], Diceware[1]-style pass phrases can be both secure and memorable. XKCD's four word example isn't secure when fast brute-force attacks are feasible, but eight words is still easily memorable and secure enough for anything. The important point here is that "random words" really does mean "random", i.e. not picked by a human. [0] https://xkcd.com/936/ https://xkcd.com/936/ [1] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware

Santosh83 9y ago
But how many of these can you remember? I currently use almost fifty different passwords. I can't imagine committing fifty different pass phrases to memory.
- Tomte 9y ago
  Use a password manager.
- heypete 9y ago
  That's what password managers are for. Just remember the password for the manager, plus maybe one or two critical accounts (e.g. email) and you're good to go. Let the manager deal with the complexity of generating and remembering random passwords.
- thesuitonym 9y ago
  I use a similar approach and have around 8 of such passwords memorized. The rest are in my password manager.
- lmm 9y ago
  I don't understand this response? A passphrase is easier to remember than a password. 50 passphrases may not be easy to remember, but they're easier than 50 passwords.
jschwartzi 9y ago
Some of my best passwords were phrases copied from discarded cartons on my desk. For example, I could choose a password, > Distributed_By: WalgreenCo. 200 Wilmont Rd. And it would both be very strong, and be difficult for someone at my desk to guess by looking at things on my desk.
- dkonofalski 9y ago
  And how do you remember which item on your desk is for which site/password?
  - falsedan 9y ago
    Post-It note under the keyboard
pixeloution 9y ago
Just to add to the above comment, a diceware passphrase is MUCH harder to break than most people realize. For example, compare the possible number of combinations: Diceware, 6 words 2.2 x 10^23 Diceware, 5 words 2.8 x 10^19 Diceware, 4 words 3.6 x 10^15 a-zA-Z0-9, symbols, 10 4.3 x 10^19 a-zA-Z0-9, 10char 8.4 x 10^17 a-zA-Z0-9, 8char 2.2 x 10^15 A 6 word diceware phrase has 100 million more combinations than the 8 character alphanumeric.
- zeveb 9y ago
  You might wish to consider these in terms of entropy, which is typically given in bits: Diceware, 6 words 77 bits Diceware, 5 words 64 bits Diceware, 4 words 51 bits a-zA-Z0-9, symbols, 10 65 bits a-zA-Z0-9, 10char 59 bits a-zA-Z0-9, 8char 50 bits For any remote site, I recommend using 22 characters from [a-zA-Z0-9]; this is 128 bits, and is easily copy-pasteable. It's highly amusing when a site tells me that such a password is insufficiently complex, given that it will never in the lifetime of the universe be guessed.
- MichaelGG 9y ago
  A 6 word phrase is also over 3x as long as an 8char password. The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.
  - WorldMaker 9y ago
    The instructions explicitly tell you not to reroll strange words. Look them up or use them as a mnemonic. Or if you don't like the strangeness in the default diceware word-list, find a word-list you like better. (There are several alternatives including fun ideas like using a foreign language word-list and learning the pronunciations and meanings of those words.) Also, the combinations list assumes that the attacker knows the method/word-list used to generate the password, which may not be foreknowledge the attacker has access to, especially in cases of giant many account password brute forcing attacks.
blakesterz 9y ago
I thought password cracking machines now guess words as well as characters? Like they will guess all 8 character passwords and will also guess all 6 word passwords using common words like they guess characters? Therefore using just a few common words stuck together with nothing else is no longer secure? (This is a genuine question because I could be totally wrong on that, I can't even remember where I heard it)
- aianus 9y ago
  The xkcd comic has all the math right there in it. They are already assuming word by word guesses not character by character guesses.
- PeterisP 9y ago
  They can, but still the passphrases are much more secure simply because there are enough different words.
discreditable 9y ago
I've come to be a big fan of diceware-style passphrases. I even wrote a generator for them based upon the EFF's wordlist: https://spg.brashear.me https://spg.brashear.me

by mrob 9y ago

Santosh83 9y ago

But how many of these can you remember? I currently use almost fifty different passwords. I can't imagine committing fifty different pass phrases to memory.

Tomte 9y ago
Use a password manager.
heypete 9y ago
That's what password managers are for. Just remember the password for the manager, plus maybe one or two critical accounts (e.g. email) and you're good to go. Let the manager deal with the complexity of generating and remembering random passwords.
thesuitonym 9y ago
I use a similar approach and have around 8 of such passwords memorized. The rest are in my password manager.
lmm 9y ago
I don't understand this response? A passphrase is easier to remember than a password. 50 passphrases may not be easy to remember, but they're easier than 50 passwords.

jschwartzi 9y ago

Some of my best passwords were phrases copied from discarded cartons on my desk. For example, I could choose a password, > Distributed_By: WalgreenCo. 200 Wilmont Rd. And it would both be very strong, and be difficult for someone at my desk to guess by looking at things on my desk.

dkonofalski 9y ago
And how do you remember which item on your desk is for which site/password?
- falsedan 9y ago
  Post-It note under the keyboard

pixeloution 9y ago

Just to add to the above comment, a diceware passphrase is MUCH harder to break than most people realize. For example, compare the possible number of combinations: Diceware, 6 words 2.2 x 10^23 Diceware, 5 words 2.8 x 10^19 Diceware, 4 words 3.6 x 10^15 a-zA-Z0-9, symbols, 10 4.3 x 10^19 a-zA-Z0-9, 10char 8.4 x 10^17 a-zA-Z0-9, 8char 2.2 x 10^15 A 6 word diceware phrase has 100 million more combinations than the 8 character alphanumeric.

zeveb 9y ago
You might wish to consider these in terms of entropy, which is typically given in bits: Diceware, 6 words 77 bits Diceware, 5 words 64 bits Diceware, 4 words 51 bits a-zA-Z0-9, symbols, 10 65 bits a-zA-Z0-9, 10char 59 bits a-zA-Z0-9, 8char 50 bits For any remote site, I recommend using 22 characters from [a-zA-Z0-9]; this is 128 bits, and is easily copy-pasteable. It's highly amusing when a site tells me that such a password is insufficiently complex, given that it will never in the lifetime of the universe be guessed.
MichaelGG 9y ago
A 6 word phrase is also over 3x as long as an 8char password. The entropy calculations are probably generous. The wordlist isn't as long as it looks, because some of the words are strange and people tend to re-roll if they get something like that. It's probably better to assume there's only 1000-2000 "words" people will safely combine.
- WorldMaker 9y ago
  The instructions explicitly tell you not to reroll strange words. Look them up or use them as a mnemonic. Or if you don't like the strangeness in the default diceware word-list, find a word-list you like better. (There are several alternatives including fun ideas like using a foreign language word-list and learning the pronunciations and meanings of those words.) Also, the combinations list assumes that the attacker knows the method/word-list used to generate the password, which may not be foreknowledge the attacker has access to, especially in cases of giant many account password brute forcing attacks.

blakesterz 9y ago

I thought password cracking machines now guess words as well as characters? Like they will guess all 8 character passwords and will also guess all 6 word passwords using common words like they guess characters? Therefore using just a few common words stuck together with nothing else is no longer secure? (This is a genuine question because I could be totally wrong on that, I can't even remember where I heard it)

aianus 9y ago
The xkcd comic has all the math right there in it. They are already assuming word by word guesses not character by character guesses.
PeterisP 9y ago
They can, but still the passphrases are much more secure simply because there are enough different words.

discreditable 9y ago

I've come to be a big fan of diceware-style passphrases. I even wrote a generator for them based upon the EFF's wordlist: https://spg.brashear.me https://spg.brashear.me