3 ms·

Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music,

Are you kidding? Those are terrible passwords, and there’s already some script kiddie out there with a password list containing the top 10 billion book, music, tv show, and movie quotes. A good password has entropy, which is not a property of the alphanumeric string but of the process used to create it. Could your password generation method plausibly have produced 2^60 alternative passwords with equal probability? Probably not. Also, never reuse passwords.

dsfyu404ed 9y ago
Are you kidding? Which is longer, the alphabet or the dictionary? There's a hell of a lot more words in any language than there are characters that make them up. N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters). Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than there are of for the same number of characters That still holds even if you make assumptions about sentence structure, common word combinations, etc, etc. There's a lot of words out there.
- Dylan16807 9y ago
  If you're using a famous quote, after a few words you're adding next to zero entropy per word. You're using an analysis for random words, which is completely different. Also in general a random word is worth around as much as two random characters. There's no clear-cut winner, use whatever you like more.
bitwize 9y ago
"One ring to rule them all" is a terrible password, but "the dark lord's unique jewelry" might be a good one.
- logfromblammo 9y ago
  "Blamm0!One ring to rule them all" would be better, in that it adds a personal salt. If your personal salt satisfies length and character class requirements by itself, so much the better. Or maybe "One And ring in to the rule darkness them bind all, them." in that it applies a personal transformation rule. Or do both. It's not as secure as other methods of password generation, but makes yours more resistant to (unabridged) dictionary attacks. If an attacker learns your personal salt, they could create a special dictionary attack just for your passwords, but this is another case of not outrunning the tiger when you can outrun your friend. Far easier to run the vanilla dictionary attack against everyone else who doesn't salt/transform.
- stordoff 9y ago
  For passwords I need to remember (rather than just putting in my password manager), I've taken to using lines from foreign content, especially if it's something I've translated myself or I've introduced some deliberate misreadings in. I imagine very few dictionaries would have "personawakokoronoka!" in them (not a password I've used, but illustrates the idea). Derived from: ペルソナは心の力 - read as "perusona wa kokoro no chikara" Then I've replaced it with the English spelling of Persona -> "persona wa kokoro no chikara" Then I replace chikara with a misreading - when I first learnt the characters, I mixed up 力 (chikara) with the katakana カ (ka) and often read both as ka -> "persona wa koroko no ka" Then remove the (unneeded) spaces and add a "!" for good measure -> "personawakokoronoka!" Dead easy for me to remember, but (I believe) difficult to derive/guess or dictionary attack (especially if I start with a longer sentence).

dsfyu404ed 9y ago

Are you kidding? Which is longer, the alphabet or the dictionary? There's a hell of a lot more words in any language than there are characters that make them up. N case insensitive words is far better than N character password from the normal set of characters (alphanumeric + special characters). Even if you restrict the combinations of words to grammatically correct sentences there's still more combinations than there are of for the same number of characters That still holds even if you make assumptions about sentence structure, common word combinations, etc, etc. There's a lot of words out there.

Dylan16807 9y ago
If you're using a famous quote, after a few words you're adding next to zero entropy per word. You're using an analysis for random words, which is completely different. Also in general a random word is worth around as much as two random characters. There's no clear-cut winner, use whatever you like more.

bitwize 9y ago

"One ring to rule them all" is a terrible password, but "the dark lord's unique jewelry" might be a good one.

logfromblammo 9y ago
"Blamm0!One ring to rule them all" would be better, in that it adds a personal salt. If your personal salt satisfies length and character class requirements by itself, so much the better. Or maybe "One And ring in to the rule darkness them bind all, them." in that it applies a personal transformation rule. Or do both. It's not as secure as other methods of password generation, but makes yours more resistant to (unabridged) dictionary attacks. If an attacker learns your personal salt, they could create a special dictionary attack just for your passwords, but this is another case of not outrunning the tiger when you can outrun your friend. Far easier to run the vanilla dictionary attack against everyone else who doesn't salt/transform.
stordoff 9y ago
For passwords I need to remember (rather than just putting in my password manager), I've taken to using lines from foreign content, especially if it's something I've translated myself or I've introduced some deliberate misreadings in. I imagine very few dictionaries would have "personawakokoronoka!" in them (not a password I've used, but illustrates the idea). Derived from: ペルソナは心の力 - read as "perusona wa kokoro no chikara" Then I've replaced it with the English spelling of Persona -> "persona wa kokoro no chikara" Then I replace chikara with a misreading - when I first learnt the characters, I mixed up 力 (chikara) with the katakana カ (ka) and often read both as ka -> "persona wa koroko no ka" Then remove the (unneeded) spaces and add a "!" for good measure -> "personawakokoronoka!" Dead easy for me to remember, but (I believe) difficult to derive/guess or dictionary attack (especially if I start with a longer sentence).