4 ms·

There are probably less non dictionary words than dictionary words, perhaps better advice is to use words from a random language other than your own so the pass

There are probably less non dictionary words than dictionary words, perhaps better advice is to use words from a random language other than your own so the password cracker might make a wrong assumption and waste his time?

mcherm 9y ago
> perhaps better advice is to use words from a random language other than your own I think you may have missed the point that the XKCD cartoon was making. The question here is NOT how to generate passwords that are hard for computers to guess. That's a solved problem: simply generate a 128-bit string with a secure random number generator, and that's your secure password that computers can't guess easily. The PROBLEM is to generate a password where the ratio of ease-for-humans-to-remember to ease-for-computers-to-guess is maximized. Using words from a language other than your own is NOT a good way to maximize this. Introducing just one more randomly-generated word from your own language will be far more effective by this criterion.
- 5555624 9y ago
  You don't need to speak a language, much less be fluent in it, to use some words from it in a password. Although I am not fluent in any language other than English, I know words in Irish Gaelic, German, Japanese, Spanish, and some other languages. It's easy to use a word I know in one of those languages as part of a password. (I do have one password that does contain a word from a language I don't speak.)
  - mannykannot 9y ago
    Up to a point, no doubt - but there is a good chance that the words you know from a language that you do not speak come from a small subset that is known by many non-speakers, so they may appear in cracking dictionaries, possibly gleaned from passwords that have been broken, or because they do sometimes appear in articles written predominantly in your language. Just for completeness, your strategy assumes the attackers are assuming a particular language - which I would guess is probably the right thing for them to do, if they are looking for low-hanging fruit.
- chaoky 9y ago
  On the flip side, most of the world is multlingual or have at least been exposed to one other language. If you speak more than one language, mixing words from two or more basically renders dictionary attacks impossible, especially with number of languages and type unknown. I have words from non native languages in my passwords and they are just as easy or easier to remember.
- Xoros 9y ago
  What about having your own pattern for upper case and lower case in the words ? Like, say, every 3rd letter of the words you choose will be upper. hoRse or baTtery etc...
  - mediocrejoker 9y ago
    Someone who actually studies this stuff can maybe correct me but I think this adds only a single bit of entropy (multiplies the possible combinations by 2) and thus is almost negligible.
    - Avernar 9y ago
      Nope, it's one bit extra entropy per character. The attacker must try all possible capitilazations of each word (horse, Horse, hOrse, HOrse, etc). You've doubled the character set so it's not negligable.
davemp 9y ago
> There are probably less non dictionary words than dictionary words There are infinitely many non dictionary words. I also didn't say to use _strictly_ non dictionary words.

mcherm 9y ago

> perhaps better advice is to use words from a random language other than your own I think you may have missed the point that the XKCD cartoon was making. The question here is NOT how to generate passwords that are hard for computers to guess. That's a solved problem: simply generate a 128-bit string with a secure random number generator, and that's your secure password that computers can't guess easily. The PROBLEM is to generate a password where the ratio of ease-for-humans-to-remember to ease-for-computers-to-guess is maximized. Using words from a language other than your own is NOT a good way to maximize this. Introducing just one more randomly-generated word from your own language will be far more effective by this criterion.

5555624 9y ago
You don't need to speak a language, much less be fluent in it, to use some words from it in a password. Although I am not fluent in any language other than English, I know words in Irish Gaelic, German, Japanese, Spanish, and some other languages. It's easy to use a word I know in one of those languages as part of a password. (I do have one password that does contain a word from a language I don't speak.)
- mannykannot 9y ago
  Up to a point, no doubt - but there is a good chance that the words you know from a language that you do not speak come from a small subset that is known by many non-speakers, so they may appear in cracking dictionaries, possibly gleaned from passwords that have been broken, or because they do sometimes appear in articles written predominantly in your language. Just for completeness, your strategy assumes the attackers are assuming a particular language - which I would guess is probably the right thing for them to do, if they are looking for low-hanging fruit.
chaoky 9y ago
On the flip side, most of the world is multlingual or have at least been exposed to one other language. If you speak more than one language, mixing words from two or more basically renders dictionary attacks impossible, especially with number of languages and type unknown. I have words from non native languages in my passwords and they are just as easy or easier to remember.
Xoros 9y ago
What about having your own pattern for upper case and lower case in the words ? Like, say, every 3rd letter of the words you choose will be upper. hoRse or baTtery etc...
- mediocrejoker 9y ago
  Someone who actually studies this stuff can maybe correct me but I think this adds only a single bit of entropy (multiplies the possible combinations by 2) and thus is almost negligible.
  - Avernar 9y ago
    Nope, it's one bit extra entropy per character. The attacker must try all possible capitilazations of each word (horse, Horse, hOrse, HOrse, etc). You've doubled the character set so it's not negligable.

davemp 9y ago

> There are probably less non dictionary words than dictionary words There are infinitely many non dictionary words. I also didn't say to use _strictly_ non dictionary words.