4 ms·

Have his rules even been proven to be right? There's that famous xkcd comic about passwords and password strength checkers like https://howsecureismypassword.n

Have his rules even been proven to be right? There's that famous xkcd comic about passwords and password strength checkers like https://howsecureismypassword.net https://howsecureismypassword.net that seem to imply otherwise. Short passwords with symbols seem easier to crack than longer ones with words put together a human could remember.

mallaidh 9y ago
Unless it's a dictionary attack.
- GhotiFish 9y ago
  the correct horse battery staple comic assumes it's a dictionary attack. https://xkcd.com/936/ https://xkcd.com/936/
Dylan16807 9y ago
Right about what, specifically? Being random is good. Being short wasn't part of the rules. Rotation is pretty bad. And words don't fix the core problem of making a good password because people love picking non-random words. In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.
- forapurpose 9y ago
  > Rotation is pretty bad Rotation is great if it's implemented correctly. The problem is that it's too much of a burden on users, therefore they implement it poorly, and then it's less useful or a weakness.
  - eksemplar 9y ago
    Rotation makes people pick things like Winter2017 or write it down, and it offers little safety because being compromised for 3 months isn't that much better than being compromised for a year.
forapurpose 9y ago
> Have his rules even been proven to be right? The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get lazy and the result is insecure passwords. There are about 95 letters, numbers, and punctuation marks and symbols. If you choose a 12 character random password, it's uncrackable by brute force. The problem is, few people want to choose and remember a 12 character random password, and fewer will do that for each of the dozens of passwords they must use, so they choose insecure, non-random passwords.

mallaidh 9y ago

Unless it's a dictionary attack.

GhotiFish 9y ago
the correct horse battery staple comic assumes it's a dictionary attack. https://xkcd.com/936/ https://xkcd.com/936/

Dylan16807 9y ago

Right about what, specifically? Being random is good. Being short wasn't part of the rules. Rotation is pretty bad. And words don't fix the core problem of making a good password because people love picking non-random words. In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.

forapurpose 9y ago
> Rotation is pretty bad Rotation is great if it's implemented correctly. The problem is that it's too much of a burden on users, therefore they implement it poorly, and then it's less useful or a weakness.
- eksemplar 9y ago
  Rotation makes people pick things like Winter2017 or write it down, and it offers little safety because being compromised for 3 months isn't that much better than being compromised for a year.

forapurpose 9y ago

> Have his rules even been proven to be right? The rules, if used properly, work perfectly. But using them properly is burdensome, which means most people get lazy and the result is insecure passwords. There are about 95 letters, numbers, and punctuation marks and symbols. If you choose a 12 character random password, it's uncrackable by brute force. The problem is, few people want to choose and remember a 12 character random password, and fewer will do that for each of the dozens of passwords they must use, so they choose insecure, non-random passwords.