5 ms·
Not really.... https://boingboing.net/2014/02/25/choosing-a-secure-password.html https://boingboing.net/2014/02/25/choosing-a-secure-password...
by daurnimator 9y ago
Not really.... https://boingboing.net/2014/02/25/choosing-a-secure-password.html https://boingboing.net/2014/02/25/choosing-a-secure-password...
- dijit 9y agoI really, strongly, disagree with the core argument of this post. His "solution" is to use shorter passwords. The XKCD method is good if you add separators, padding, etc; as expressed featured on xkpasswd.net I highly recommend generating a password and then adding something unique to it. For instance, a password I might generate would be: $66=mine=BODY=spot=STOP=23$-d1j1t It's memorable enough, and I highly doubt it's easily crackable. Certainly no less than 'tlpw2m'.
- KozmoNau7 9y agoEven just //44$random$WORDS$11// is effectively just as safe, in the real world. Especially if you use gibberish words that aren't in any commonly used dictionary.
- whyever 9y agoThat blog post does not give any convincing argument against XKCD-style passwords. It seems to incorrectly assume they are "security by obscurity".
- danielbarla 9y agoHonestly, I had a good laugh until I saw who wrote that. To be fair, I think Bruce is saying that most people will fail to pick truly random words, which is fair. However, as you point out, it provides no argument against passphrases, aside from referring to them as a "trick". I still don't know how people look at the XKCD explanation (where Randall Munroe actually does a pretty good job of correctly and succinctly detailing the strength of the two password styles [1]), and call it a trick. The only trick is that your mind has an easier time remembering passphrases than it does remembering a similar strength random string. [1] Specifically, Randall already assumes that the cracker knows that the password is a passphrase, and has the 1000-word list it was picked from.