6 ms·

You can always use XKCD's password methodology ;) https://xkcd.com/936/ https://xkcd.com/936/

daurnimator 9y ago
Not really.... https://boingboing.net/2014/02/25/choosing-a-secure-password.html https://boingboing.net/2014/02/25/choosing-a-secure-password...
- dijit 9y ago
  I really, strongly, disagree with the core argument of this post. His "solution" is to use shorter passwords. The XKCD method is good if you add separators, padding, etc; as expressed featured on xkpasswd.net I highly recommend generating a password and then adding something unique to it. For instance, a password I might generate would be: $66=mine=BODY=spot=STOP=23$-d1j1t It's memorable enough, and I highly doubt it's easily crackable. Certainly no less than 'tlpw2m'.
  - KozmoNau7 9y ago
    Even just //44$random$WORDS$11// is effectively just as safe, in the real world. Especially if you use gibberish words that aren't in any commonly used dictionary.
- whyever 9y ago
  That blog post does not give any convincing argument against XKCD-style passwords. It seems to incorrectly assume they are "security by obscurity".
  - danielbarla 9y ago
    Honestly, I had a good laugh until I saw who wrote that. To be fair, I think Bruce is saying that most people will fail to pick truly random words, which is fair. However, as you point out, it provides no argument against passphrases, aside from referring to them as a "trick". I still don't know how people look at the XKCD explanation (where Randall Munroe actually does a pretty good job of correctly and succinctly detailing the strength of the two password styles [1]), and call it a trick. The only trick is that your mind has an easier time remembering passphrases than it does remembering a similar strength random string. [1] Specifically, Randall already assumes that the cracker knows that the password is a passphrase, and has the 1000-word list it was picked from.
s_gourichon 9y ago
Those pushed into FUD against XKCD password scheme can simply add more words. All arguments in https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength https://www.explainxkcd.com/wiki/index.php/936:_Password_Str... remain, including the ease of remembering. You still definitely have to accept at least four words actually randomly generated (this is important, else the scheme falls apart horribly). Accepting 6 random words is pretty secure IMHO.
josefresco 9y ago
See also: zxcvbn https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/
mikegerwitz 9y ago
You need to do it properly; the comic is misleading on its own. https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

Not really.... https://boingboing.net/2014/02/25/choosing-a-secure-password.html https://boingboing.net/2014/02/25/choosing-a-secure-password...

dijit 9y ago
I really, strongly, disagree with the core argument of this post. His "solution" is to use shorter passwords. The XKCD method is good if you add separators, padding, etc; as expressed featured on xkpasswd.net I highly recommend generating a password and then adding something unique to it. For instance, a password I might generate would be: $66=mine=BODY=spot=STOP=23$-d1j1t It's memorable enough, and I highly doubt it's easily crackable. Certainly no less than 'tlpw2m'.
- KozmoNau7 9y ago
  Even just //44$random$WORDS$11// is effectively just as safe, in the real world. Especially if you use gibberish words that aren't in any commonly used dictionary.
whyever 9y ago
That blog post does not give any convincing argument against XKCD-style passwords. It seems to incorrectly assume they are "security by obscurity".
- danielbarla 9y ago
  Honestly, I had a good laugh until I saw who wrote that. To be fair, I think Bruce is saying that most people will fail to pick truly random words, which is fair. However, as you point out, it provides no argument against passphrases, aside from referring to them as a "trick". I still don't know how people look at the XKCD explanation (where Randall Munroe actually does a pretty good job of correctly and succinctly detailing the strength of the two password styles [1]), and call it a trick. The only trick is that your mind has an easier time remembering passphrases than it does remembering a similar strength random string. [1] Specifically, Randall already assumes that the cracker knows that the password is a passphrase, and has the 1000-word list it was picked from.

s_gourichon 9y ago

Those pushed into FUD against XKCD password scheme can simply add more words. All arguments in https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength https://www.explainxkcd.com/wiki/index.php/936:_Password_Str... remain, including the ease of remembering. You still definitely have to accept at least four words actually randomly generated (this is important, else the scheme falls apart horribly). Accepting 6 random words is pretty secure IMHO.

josefresco 9y ago

See also: zxcvbn https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/

mikegerwitz 9y ago

You need to do it properly; the comic is misleading on its own. https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...