7 ms·

Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

43 points by indigodaddy 8y ago

guitarbill 8y ago
i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.
- strictnein 8y ago
  Yep, exactly this. Perfect is the enemy of good. This is like the people who argue against your nontechnical relatives writing down their passwords. In reality, if they do that and have unique passwords for all their accounts, they're actually doing really well! The base comparison seems to be a mixed character password with a length of 14. That's far more complex than the vast majority of passwords out there, so the simple three word password would be significantly more "secure" than the average password used. Password managers are relatively easy to setup for technical people, but getting everything working on your home pc, tablet, and phone isn't a simple task for many people. The threat 99.999999% of us face isn't that someone will bruteforce our password using a Cray. The attack that is currently occurring against you and the people you know is credential stuffing, which simply targets password reuse.
- PaulMoore 8y ago
  I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.
  - guitarbill 8y ago
    That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would. But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.
    - PaulMoore 8y ago
      I'm guessing you mean hashed, or am I being pedantic? ;) Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe. Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.
scandox 8y ago
The simple answer here is to use non-word words. A sample might be: eggscellent frantillion scrofulon Ok. I'm skewing to the letter 'L' - but they don't have to know that.
- ritchiea 8y ago
  You can also, add irregular punctuation & capitalization, throw in some numbers within words, include words from other languages that you know or look up. Or use near words of other languages. I have always thought of "3 random words" as a starting point for randomizing a password not literal advice to follow.
  - SketchySeaBeast 8y ago
    I wonder about that - given that a dictionary attack relies on known values (and can substitute out "l"'s for "1" and "!") - what happens if you write something like "Ger!bils"? Is the dictionary attack totally nullified, or is that possibly accounted for? That would seem to open up the potential space a ton.
    - romdev 8y ago
      Depends on the attacker, but it's probably accounted for at least partially. In some passwords where I don't care much about security I'll use this technique and some personal, site-specific mnemonic - if their logo reminded me of a gerbil, I might start with the name of a pet gerbil I once had and obfuscate it with character replacement or keyboard proximity replacement (same characters, one row up or down). These passwords are always unique to the site, which doesn't get any financial info. When I need a secure password that's easy to remember I'll obfuscate the initials of a memorable passphrase from a joke, poem, song or book. My password manager is offline (remember the LastPass hack?) so I need to read from it once and type it in. Update: I remembered this old article that describes some of the techniques that have been used to crack passwords, including 133t-character replacement: https://arstechnica.com/information-technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ https://arstechnica.com/information-technology/2013/05/how-c...
mbreedlove 8y ago
I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages. An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.
- makomk 8y ago
  Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be expected to remember passwords strong enough to resist brute force at the speed we can achieve these days if they're just hashed with MD5, SHA1, or any of the other cryptographic hashes. That's true whether they're random words, random letters, or any other scheme you can think up.
- jeremysalwen 8y ago
  Yup, also no mention of salting the passwords. The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... which cracks bcrypt (at a weak security factor) two million times slower. So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand years.
  - PaulMoore 8y ago
    Salts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output. Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords. There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.
gravy 8y ago
The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
- 2arrs2ells 8y ago
  Use a password manager! The transition takes some time/effort, but once you have one fully set up (I adore 1password) it's both easier and far more secure than any scheme you keep in your head. Re: losing access - a 1password family plan allows your family members to recover your account. Or just write your master password down on paper and store it somewhere secure - like a safe or safety deposit box.
- mattferderer 8y ago
  Export your passwords on occasion & store somewhere safe is one method. You can export passwords in Chrome. Type chrome://settings/passwords into the URL & click the 3 icon settings to the right of Saved Passwords. Another option is to test the forgot password of your chosen password manager. See what options are & how comfortable they make you.
- falcolas 8y ago
  To keep track of your master password, just write it down and put it in your wallet/purse. We're used to and experienced with securing physical objects, and while it still offers an avenue to expose all your passwords, it requires a lot of extra work to do so. Basically, storing your master password physically only really vulnerable to highly targeted attacks.
  - thebluehawk 8y ago
    I would put it somewhere more secure than wallet/purse, unless you are forgetting your master password daily. I put mine in a place similar to a hidden folder in a filing cabinet. I haven't forgotten my master password yet, but I know that it's there if I need it.
scblock 8y ago
I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".
- TotempaaltJ 8y ago
  Here's 1Password's article on creating a master password (spoilers: it is _way_ better): https://blog.1password.com/toward-better-master-passwords/ https://blog.1password.com/toward-better-master-passwords/
  - daveFNbuck 8y ago
    > Change a weak Master Password, otherwise leave it be I wish LastPass would take this advice. They ask me to change my master password every time I log in because I've had the same one for a long time.
deleted 8y ago
[deleted]
nix0n 8y ago
According to XKCD[0] you need a fourth random word. [0]https://xkcd.com/936/ https://xkcd.com/936/
- josefresco 8y ago
  Also this, which references the same comic: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
akatechis 8y ago
What I don't understand is the math. Author makes the claim that using 3 words changes the combinatorics from 62^12 (62 characters, in 12 positions) to 20,000^3 (20k words, in 3 positions) but a hashing algorithm doesn't work with words, it works with characters, so if the words are 4 characters each, you've still got 12 characters to fill. Since an attacker doesn't know that you've not used symbols or numbers, they can't reduce the problem space to 26^12. Right? Have I missed something in the article that would make the connection? EDIT: Yes, hashing works with bytes, so technically, it can be even stronger if we include charsets from other scripts in the problem space.
- eric_bullington 8y ago
  Exactly. The attacker would have to try a word-based attack to benefit from the ~7 hour time-to-crack. So I disagree with the article's advice: "Don't use words in passwords. Ever." Yes, you should use caution when using words in a password, but even if you use a password manager, a 5- or 6-word diceware password is ideal. Even better if you stick on a 4-digit numeric "salt" to your diceware passwords. But yes, I do agree that a 3-word password is too short (~33 bits of entropy[1]). It should be at least 5 words (~55 bits). And you really need at least 6 words (~66 bits, obviously) for a master password. 1. Using EFF's user-friendly, ~1200 word list for diceware.
- braincoke 8y ago
  I haven't had the time to read the full article, however I think I might have an answer to your question. The entropy computes the strength of the algorithm used to generate passwords, not the strength of the password itself. So basically, you are getting the strength of the password if the attacker knows the algorithm. I couldn't find a better source than this stackexchange thread : https://security.stackexchange.com/questions/167235/how-does-the-password-tr0ub4dor3-have-28-bits-of-entropy https://security.stackexchange.com/questions/167235/how-does... Hope it helps
- ozim 8y ago
  Imagine you got database with 100k passwords to crack. You want to crack as much passwords as possible in shortest time. You don't have time to go full brute force, and also you don't even know what was the length of password. So first you get all dumb single passwords from dictionary (love, hate, fuck, password), if you have cracking rig or some beefed up server you will go through 100k passwords and all single words, starting with ones commonly used very quickly (sorry, but math I leave for others). Even though hash algorithm works on characters you just make hashes from dictionary words and compare to hash. You can go even further and have list of stupid words already hashed, so now you just need to compare prepared hashes (google rainbow tables), nice optimization. Then you can have improved dictionary with l33t sp33k. Let's say you get 10% of passwords this way form 100k. Now you see other people have stronger passwords, so still instead of going random generate combinations of 2 words and run through database, then you can go with combinations of 3 words. This will let's say get you another 20% of passwords. There are many other optimizations you can come up with. Passwords that you did not cracked you just leave, you don't have incentives to run 12 character full brute force combinations. You have to get passwords as soon as you have them and start credential stuffing everywhere to get as much as you can. It is not some fun and games to crack your school mate password to post "I am stupid" on his wall.
mcphage 8y ago
This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first, then brute force.
- hyperpape 8y ago
  If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n, because you share effort between the two schemes. A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.
  - mcphage 8y ago
    That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.
    - hyperpape 8y ago
      Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If you use 5+symbols you’re probably creating enough entropy, but you’re veering into hard to type, might as well just use gibberish territory.
      - mcphage 8y ago
        They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?
raverbashing 8y ago
Yes, if you use 3 common words it's not a good idea. But most people don't, and the attacker doesn't know that. It's useless to use a strong password if it's going to be stored in plaintext on some service.
evrydayhustling 8y ago
I guess this is a good primer for some folks, but there are two really spurious arguments: (1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability). (2) Faced with the suggestion of adding more words, they show that 4 is crackable. But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect. This article should be as simple as "use 5 random words, not 4". Password managers have their own issues, both with usability and their tendency to provide centralized targets. And, they still require a secure passkey themselves -- for which a long random phrase is a perfectly reasonable approach.
- closetohome 8y ago
  > "use 5 random words, not 4" But that would actually be useful, and get fewer hits.
- PaulMoore 8y ago
  Hi evrydayhustling "If you use a randomizer, which you should" That's a big IF. People should use a password manager, or create unique random passwords for every site... but they don't. Of course, if someone other than you chooses the words, you'd need to include the entire dictionary. "But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect." I haven't excluded this; I make reference to DiceWare at the bottom of the page. This covers both using more words chosen at random, which is the entire point. Thanks
  - evrydayhustling 8y ago
    Oops - I didn't notice this part was related because I haven't used diceware! I still think it's weird to put something this fundamental to your argument in a footnote under one product above, but apologies for implying you if ignored it entirely.
dawhizkid 8y ago
what if you use a non-dictionary word as one of the three words?
jsgo 8y ago
Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning): 1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of those: regardless if my password is purplepenguinparade because you don't know that I've artificially set parameters for my password within the existing parameters. It could be argued you could try all permutations of lowercase characters first (base 26) but then how do you know to go to 26^19 before adding more to the base? 1a) if the hashed passwords give away tells as to what the decoded password is like (in this case 3 words lowercase), that'd seem like a concern about the encryption moreso than the password. 2) The 20,000 and 40,000 part seems like a meaningless piece of trivia. What if one of the words I want to use doesn't fall in your 20,000-40,000 word store? You're never going to crack my password. Better go the full 171,000 or whatever it was and hope I don't slip an extra character of the numeric, special character, upper/lower case variety. ------------- While I do personally use a password manager, it isn't perfect for me either (requires loading 1Password 2x on Windows 10 for me because the first attempt does nothing, but loads on second try). I do hope more OS creators do like Apple did to better tie in with password managers and that may help alleviate some of it). So I don't see my parents or grandparents, for example, using one. That said, for the rank and file folks that are taking their security advice from the government and police departments, I think pushing for various words in sequence is much better advice than "8 characters in length because it takes longer to guess than 6 characters" or whatever it is that people predominantly operate under and usually ties back to something about themselves that someone with some familiarity about them could guess (if I recall, this is what happened to Sarah Palin when she was hacked shortly after being McCain's VP nominee).
- sidedishes 8y ago
  To your first point, I think it's about priors about password choices. To take an extreme example, even if a site allows up to 32 alphanumeric characters, we don't just say passwords on this site are uniformly secure under metric (26+26+10)^32 because theoretically a brute-force approach would have to go through up that many permutations. (Such a number is an upper bound on your password security.) In particular, short passwords with up to 8 characters are weaker because they form a small and common subset of passwords that people often draw from, and attackers exploit that by trying short passwords first. Passwords that are 3 dictionary words, with possibly some small perturbations like punctuation inserts or replacements (which helps but only expands the space so much), also form a relatively small subset of passwords that people increasingly draw upon, and attackers aware of this will tailor their brute-force search accordingly.
strictnein 8y ago
No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first place. Capitalize one random letter in all of that, throw a number between the second or third letter, add dashes, whatever and they're totally screwed. Game over, you win.
- dwighttk 8y ago
  I think they are trying to point out that if "use three words" gets popular enough then it isn't good for any individual who does so.
  - PaulMoore 8y ago
    Thank you! Spot on.
- copperx 8y ago
  > The only "really bad idea" for passwords is password reuse. But is that really the ONLY "really bad idea" when using passwords?
  - strictnein 8y ago
    True true. It's not the only one :)
- UncleMeat 8y ago
  Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.
  - em-bee 8y ago
    agreed, the threat of online passwords is a break-in revealing the password database which happens to be in plain text 'ooops!' and even if the password list is not in plain text, but the attacker manages to find your 3-word password, if you didn't reuse that password any where else, then it can't be used to get into any of your other accounts. and for the account for which they found your password, they already broke into that system, so no additional loss here either. greetings, eMBee.
billfruit 8y ago
I really do hate that many websites/services put a max length on passwords that is really short like 16.I remember even outlook.com restricting it to 16 chars,really bad for people who would use long sentence like passwords.
josefresco 8y ago
This was posted here a few years back, and it's still a tool I use: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-pass... Anyone else still using this?
hyperpape 8y ago
While I use strong passwords (better safe than sorry), how important is it really to worry about this kind of offline attack if you don't reuse passwords?
danShumway 8y ago
Outside of the Twitter-verse, who actually advocates to use a 3 word passphrase? Use 5 or 6 words and the problems listed here vanish. Also, use diceware or an equivalent generator. If you're writing out a string of letters and characters, that's not going to be random either. The only way to generate a random password is to use a device that gives you random numbers. If you're relying on your working vocabulary and picking passphrases out of thin air, then your 12 character letters, numbers, and symbols isn't going to very good either, because you're not good at choosing things randomly and picking letters out of thin air won't be any better than words. This entire article could be rewritten as one sentence: "Use a program or a dictionary/dice to generate your >4 word passphrase."
- jarfil 8y ago
  It doesn't even have to be truly random, just "random enough". If you were to use a passphrase like "Use 5 or 6 words and the problems listed here vanish", that wouldn't be random per se, but for an attacker it might as well be.
scotchio 8y ago
Quickly just sharing: I must have read online for 2 solid years about how much better/safer and secure Password Managers are before I finally switched to one. After switching though, the CONVENIENCE of a password manager is the most undersold part of it. Nothing seems to be perfect solution with security, but if you're reading this and haven't switched to a password manager for whatever reason, security benefits aside I would highly recommend finally doing it.
- SketchySeaBeast 8y ago
  > CONVENIENCE of a password manager Absolutely. The only issue I have is when I'm logging into something I log into every day, but other than that it's great to log into the manager and go "ah, here's the password I set up a decade ago".
dominicr 8y ago
I think this misses who the intended audience of this simple password advice is. Hint: it's not us. Normal people's passwords are terrible! It's the site name, their name, "password123" or a single word with a number on the end. A lot of advice about passwords is aimed at getting normal people to make easy steps to make their passwords better, not perfectly uncrackable. Complex passwords don't work for lay users and most of them aren't going to switch to password managers. So getting people to make small steps, like not reusing the same password and making it more than one word and a number, does make a big difference to users' security.
jlmcgraw 8y ago
I wrote a perl script a while back to create random passphrases based on a random mnemonic word It seems like a good idea to me but I’m not knowledgeable enough about cryptography to know if that’s really true and would be very interested to hear from anyone who does know https://github.com/jlmcgraw/mnemonic_passphrase https://github.com/jlmcgraw/mnemonic_passphrase
mcstafford 8y ago
Here's a sample from my 4x dictionary-based generator. Let me know how quickly you can re-create it via brute force. Pocahontas-ballot-balustrade-blackouts https://www.xkcd.com/936/ https://www.xkcd.com/936/
norswap 8y ago
I believe it comes from a good place, but this post is bad. Why? Because it doesn't apply the same comparison standard to character-based passwords than to word-based passwords. Sure, we only use a few common dictionary words. But by the same token, our character-based passwords aren't random strings either: they are variation based on random words. This is the basis of the xkcd advice to use 4 random words: https://xkcd.com/936/ https://xkcd.com/936/ Notice Randall gives each word 11 bits of entropy, meaning he considers each word is chosen at random amongst a pool of ~2000 words. Yet that base is still much bigger than ~64 for characters. If you take 3 common words, you get ~8 billion possibilities. 4 common words: 17,000 billion. That's much more than than ~400 billion for a perfectly random (again: that's not the case in practice) password of 12 characters. And four words is easy to remember, 12 random characters is HARD. If anything bad can be said about the xkcd comic, it's that it doesn't hammer the point that it has to be FOUR words. As three is much less secure (but still probably more secure than the 12 characters password people are likely to use in practice).
- drbawb 8y ago
  This post also fails to take into account people's exposure to fiction. My vocabulary may be limited, but many of my passphrases use nouns/concepts/slang that are drawn from video games, novels, movies, etc. Some of these works (authored by family, friends, and myself) aren't even published. I reckon the chance of these "words" being included in some cracker's dictionary is quite close to zero. Also as you point out their analysis of the entropy of random words is quite uncharitable. It fails to account for any sort of punctuation, capitalization, etc. Is my password "correct horse battery staple" or "correct Horse, battery staple!" or "CORRECT HORSE! Battery staple.", etc. There is a lot of entropy inherent in crafting a phrase.
  - norswap 8y ago
    The point being that even so it's already better while simultaneously being easier to remember (because indeed, what did I capitalize again?).
atoponce 8y ago
Niceware ships 65,536 unique words. 3 words chosen randomly is 1 "password" of 281,474,976,710,656 possibilities. https://diracdeltas.github.io/niceware https://diracdeltas.github.io/niceware If that password was hashed with a single pass of vanilla MD5, the Jeremi Gonsey's cluster of 8 Nvidia GTX 1080i GPUs [2] would be running at 307,200,000,000 hashes per second. https://gist.github.com/epixoip/ace60d09981be09544fdd35005051505 https://gist.github.com/epixoip/ace60d09981be09544fdd3500505... In order to exhaust half of the keyspace, so odds would be in the favor of the password cracker finding the original hash, they would need to search only 140,737,488,355,328 hashes. At 307.2 gigahashes per second, this would take approximately 458 seconds, or just under 8 hours using the Niceware list. However, jumping to 4 random words grows that time by a factor of 65,536, which means reaching 50% exhaustion would take approximately 1 full year. Moving to 5 randomly generated Niceware words, and it's impractical to attempt cracking the MD5 hash. Cherry-picking 3 words is a little dishonest for the discussion surrounding password security. The right "best answer" for password generation is to use a password manager, no argument there. And I don't know of any password generators that generate passphrases by default, Niceware, Diceware, or otherwise. But if a user wants a passphrase instead, I don't know of a security expert who would recommend 3 words.

43 points by indigodaddy 8y ago

i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.

strictnein 8y ago
Yep, exactly this. Perfect is the enemy of good. This is like the people who argue against your nontechnical relatives writing down their passwords. In reality, if they do that and have unique passwords for all their accounts, they're actually doing really well! The base comparison seems to be a mixed character password with a length of 14. That's far more complex than the vast majority of passwords out there, so the simple three word password would be significantly more "secure" than the average password used. Password managers are relatively easy to setup for technical people, but getting everything working on your home pc, tablet, and phone isn't a simple task for many people. The threat 99.999999% of us face isn't that someone will bruteforce our password using a Cray. The attack that is currently occurring against you and the people you know is credential stuffing, which simply targets password reuse.
PaulMoore 8y ago
I'm sorry, but that's nonsense if you actually think about it. Existing passwords are broken in a matter of milliseconds, perhaps a few seconds. Do you honestly believe it's sufficient consolation to an end-user to know it took 40 seconds instead? The end result is the same... they're breached. My point is simple. We already have FAR superior techniques in 2018 and wasting time advocating questionable techniques is an exercise in futility. The people who follow the advice are still at considerable risk, the majority will ignore it and remain almost as vulnerable.
- guitarbill 8y ago
  That's if they're encrypted in the first place. Avoiding re-use is far more important, as others have said in this thread. And humans are bad at remembering random combinations of letters and numbers, but ok at remembering words. If I could get my parents to use a password manager, I would. But until then, three words is better than re-use, and your pedantry still isn't helping the people who need it most, i.e. people lacking technical literacy in the first place.
  - PaulMoore 8y ago
    I'm guessing you mean hashed, or am I being pedantic? ;) Anything is better than re-use, that's not really an argument. If I recommended using "1", "2", "3" for three different sites, that's technically better than reusing the same password... but still not safe. Labelling it as pedantry really ignores the wider point. Having 3 unique passwords which take 40 seconds to break really isn't a great improvement, neither is it pedantic to point out that fact.

scandox 8y ago

The simple answer here is to use non-word words. A sample might be: eggscellent frantillion scrofulon Ok. I'm skewing to the letter 'L' - but they don't have to know that.

ritchiea 8y ago
You can also, add irregular punctuation & capitalization, throw in some numbers within words, include words from other languages that you know or look up. Or use near words of other languages. I have always thought of "3 random words" as a starting point for randomizing a password not literal advice to follow.
- SketchySeaBeast 8y ago
  I wonder about that - given that a dictionary attack relies on known values (and can substitute out "l"'s for "1" and "!") - what happens if you write something like "Ger!bils"? Is the dictionary attack totally nullified, or is that possibly accounted for? That would seem to open up the potential space a ton.
  - romdev 8y ago
    Depends on the attacker, but it's probably accounted for at least partially. In some passwords where I don't care much about security I'll use this technique and some personal, site-specific mnemonic - if their logo reminded me of a gerbil, I might start with the name of a pet gerbil I once had and obfuscate it with character replacement or keyboard proximity replacement (same characters, one row up or down). These passwords are always unique to the site, which doesn't get any financial info. When I need a secure password that's easy to remember I'll obfuscate the initials of a memorable passphrase from a joke, poem, song or book. My password manager is offline (remember the LastPass hack?) so I need to read from it once and type it in. Update: I remembered this old article that describes some of the techniques that have been used to crack passwords, including 133t-character replacement: https://arstechnica.com/information-technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ https://arstechnica.com/information-technology/2013/05/how-c...

mbreedlove 8y ago

I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages. An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.

makomk 8y ago
Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be expected to remember passwords strong enough to resist brute force at the speed we can achieve these days if they're just hashed with MD5, SHA1, or any of the other cryptographic hashes. That's true whether they're random words, random letters, or any other scheme you can think up.
jeremysalwen 8y ago
Yup, also no mention of salting the passwords. The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... which cracks bcrypt (at a weak security factor) two million times slower. So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand years.
- PaulMoore 8y ago
  Salts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output. Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords. There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.

gravy 8y ago

The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?

2arrs2ells 8y ago
Use a password manager! The transition takes some time/effort, but once you have one fully set up (I adore 1password) it's both easier and far more secure than any scheme you keep in your head. Re: losing access - a 1password family plan allows your family members to recover your account. Or just write your master password down on paper and store it somewhere secure - like a safe or safety deposit box.
mattferderer 8y ago
Export your passwords on occasion & store somewhere safe is one method. You can export passwords in Chrome. Type chrome://settings/passwords into the URL & click the 3 icon settings to the right of Saved Passwords. Another option is to test the forgot password of your chosen password manager. See what options are & how comfortable they make you.
falcolas 8y ago
To keep track of your master password, just write it down and put it in your wallet/purse. We're used to and experienced with securing physical objects, and while it still offers an avenue to expose all your passwords, it requires a lot of extra work to do so. Basically, storing your master password physically only really vulnerable to highly targeted attacks.
- thebluehawk 8y ago
  I would put it somewhere more secure than wallet/purse, unless you are forgetting your master password daily. I put mine in a place similar to a hidden folder in a filing cabinet. I haven't forgotten my master password yet, but I know that it's there if I need it.

scblock 8y ago

I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".

TotempaaltJ 8y ago
Here's 1Password's article on creating a master password (spoilers: it is _way_ better): https://blog.1password.com/toward-better-master-passwords/ https://blog.1password.com/toward-better-master-passwords/
- daveFNbuck 8y ago
  > Change a weak Master Password, otherwise leave it be I wish LastPass would take this advice. They ask me to change my master password every time I log in because I've had the same one for a long time.

deleted 8y ago

[deleted]

nix0n 8y ago

According to XKCD[0] you need a fourth random word. [0]https://xkcd.com/936/ https://xkcd.com/936/

josefresco 8y ago
Also this, which references the same comic: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn

akatechis 8y ago

What I don't understand is the math. Author makes the claim that using 3 words changes the combinatorics from 62^12 (62 characters, in 12 positions) to 20,000^3 (20k words, in 3 positions) but a hashing algorithm doesn't work with words, it works with characters, so if the words are 4 characters each, you've still got 12 characters to fill. Since an attacker doesn't know that you've not used symbols or numbers, they can't reduce the problem space to 26^12. Right? Have I missed something in the article that would make the connection? EDIT: Yes, hashing works with bytes, so technically, it can be even stronger if we include charsets from other scripts in the problem space.

eric_bullington 8y ago
Exactly. The attacker would have to try a word-based attack to benefit from the ~7 hour time-to-crack. So I disagree with the article's advice: "Don't use words in passwords. Ever." Yes, you should use caution when using words in a password, but even if you use a password manager, a 5- or 6-word diceware password is ideal. Even better if you stick on a 4-digit numeric "salt" to your diceware passwords. But yes, I do agree that a 3-word password is too short (~33 bits of entropy[1]). It should be at least 5 words (~55 bits). And you really need at least 6 words (~66 bits, obviously) for a master password. 1. Using EFF's user-friendly, ~1200 word list for diceware.
braincoke 8y ago
I haven't had the time to read the full article, however I think I might have an answer to your question. The entropy computes the strength of the algorithm used to generate passwords, not the strength of the password itself. So basically, you are getting the strength of the password if the attacker knows the algorithm. I couldn't find a better source than this stackexchange thread : https://security.stackexchange.com/questions/167235/how-does-the-password-tr0ub4dor3-have-28-bits-of-entropy https://security.stackexchange.com/questions/167235/how-does... Hope it helps
ozim 8y ago
Imagine you got database with 100k passwords to crack. You want to crack as much passwords as possible in shortest time. You don't have time to go full brute force, and also you don't even know what was the length of password. So first you get all dumb single passwords from dictionary (love, hate, fuck, password), if you have cracking rig or some beefed up server you will go through 100k passwords and all single words, starting with ones commonly used very quickly (sorry, but math I leave for others). Even though hash algorithm works on characters you just make hashes from dictionary words and compare to hash. You can go even further and have list of stupid words already hashed, so now you just need to compare prepared hashes (google rainbow tables), nice optimization. Then you can have improved dictionary with l33t sp33k. Let's say you get 10% of passwords this way form 100k. Now you see other people have stronger passwords, so still instead of going random generate combinations of 2 words and run through database, then you can go with combinations of 3 words. This will let's say get you another 20% of passwords. There are many other optimizations you can come up with. Passwords that you did not cracked you just leave, you don't have incentives to run 12 character full brute force combinations. You have to get passwords as soon as you have them and start credential stuffing everywhere to get as much as you can. It is not some fun and games to crack your school mate password to post "I am stupid" on his wall.

mcphage 8y ago

This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first, then brute force.

hyperpape 8y ago
If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n, because you share effort between the two schemes. A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.
- mcphage 8y ago
  That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.
  - hyperpape 8y ago
    Most of those schemes fall into the category of: sym,word,sym,word,sym,word,sym Where sym is 0-1 symbols or numbers, and comma indicates concatenation. If you use 5+symbols you’re probably creating enough entropy, but you’re veering into hard to type, might as well just use gibberish territory.
    - mcphage 8y ago
      They are, but like—how many of these schemas is a cracker going to try between "test just words" and "brute force". There's a ton of possibilities, and I really don't think they'll bother enumerating them all. That's the point—the cracker doesn't know what schema you're going to use. Sure, maybe they'll test word lists. But not all of: * word sym * sym word * word word sym * word sym word * sym word word * word word word sym * word word sym word * word sym word word * sym word word word And then what about 2 symbols? Or separating words with spaces, or dashes, or underscores, or nothing? How many schemas are we up to by now? At what point is there no value to trying all of these, and just running the brute force lookup?

raverbashing 8y ago

Yes, if you use 3 common words it's not a good idea. But most people don't, and the attacker doesn't know that. It's useless to use a strong password if it's going to be stored in plaintext on some service.

evrydayhustling 8y ago

I guess this is a good primer for some folks, but there are two really spurious arguments: (1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability). (2) Faced with the suggestion of adding more words, they show that 4 is crackable. But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect. This article should be as simple as "use 5 random words, not 4". Password managers have their own issues, both with usability and their tendency to provide centralized targets. And, they still require a secure passkey themselves -- for which a long random phrase is a perfectly reasonable approach.

closetohome 8y ago
> "use 5 random words, not 4" But that would actually be useful, and get fewer hits.
PaulMoore 8y ago
Hi evrydayhustling "If you use a randomizer, which you should" That's a big IF. People should use a password manager, or create unique random passwords for every site... but they don't. Of course, if someone other than you chooses the words, you'd need to include the entire dictionary. "But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect." I haven't excluded this; I make reference to DiceWare at the bottom of the page. This covers both using more words chosen at random, which is the entire point. Thanks
- evrydayhustling 8y ago
  Oops - I didn't notice this part was related because I haven't used diceware! I still think it's weird to put something this fundamental to your argument in a footnote under one product above, but apologies for implying you if ignored it entirely.

dawhizkid 8y ago

what if you use a non-dictionary word as one of the three words?

jsgo 8y ago

Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning): 1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of those: regardless if my password is purplepenguinparade because you don't know that I've artificially set parameters for my password within the existing parameters. It could be argued you could try all permutations of lowercase characters first (base 26) but then how do you know to go to 26^19 before adding more to the base? 1a) if the hashed passwords give away tells as to what the decoded password is like (in this case 3 words lowercase), that'd seem like a concern about the encryption moreso than the password. 2) The 20,000 and 40,000 part seems like a meaningless piece of trivia. What if one of the words I want to use doesn't fall in your 20,000-40,000 word store? You're never going to crack my password. Better go the full 171,000 or whatever it was and hope I don't slip an extra character of the numeric, special character, upper/lower case variety. ------------- While I do personally use a password manager, it isn't perfect for me either (requires loading 1Password 2x on Windows 10 for me because the first attempt does nothing, but loads on second try). I do hope more OS creators do like Apple did to better tie in with password managers and that may help alleviate some of it). So I don't see my parents or grandparents, for example, using one. That said, for the rank and file folks that are taking their security advice from the government and police departments, I think pushing for various words in sequence is much better advice than "8 characters in length because it takes longer to guess than 6 characters" or whatever it is that people predominantly operate under and usually ties back to something about themselves that someone with some familiarity about them could guess (if I recall, this is what happened to Sarah Palin when she was hacked shortly after being McCain's VP nominee).

sidedishes 8y ago
To your first point, I think it's about priors about password choices. To take an extreme example, even if a site allows up to 32 alphanumeric characters, we don't just say passwords on this site are uniformly secure under metric (26+26+10)^32 because theoretically a brute-force approach would have to go through up that many permutations. (Such a number is an upper bound on your password security.) In particular, short passwords with up to 8 characters are weaker because they form a small and common subset of passwords that people often draw from, and attackers exploit that by trying short passwords first. Passwords that are 3 dictionary words, with possibly some small perturbations like punctuation inserts or replacements (which helps but only expands the space so much), also form a relatively small subset of passwords that people increasingly draw upon, and attackers aware of this will tailor their brute-force search accordingly.

strictnein 8y ago

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first place. Capitalize one random letter in all of that, throw a number between the second or third letter, add dashes, whatever and they're totally screwed. Game over, you win.

dwighttk 8y ago
I think they are trying to point out that if "use three words" gets popular enough then it isn't good for any individual who does so.
- PaulMoore 8y ago
  Thank you! Spot on.
copperx 8y ago
> The only "really bad idea" for passwords is password reuse. But is that really the ONLY "really bad idea" when using passwords?
- strictnein 8y ago
  True true. It's not the only one :)
UncleMeat 8y ago
Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.
- em-bee 8y ago
  agreed, the threat of online passwords is a break-in revealing the password database which happens to be in plain text 'ooops!' and even if the password list is not in plain text, but the attacker manages to find your 3-word password, if you didn't reuse that password any where else, then it can't be used to get into any of your other accounts. and for the account for which they found your password, they already broke into that system, so no additional loss here either. greetings, eMBee.

billfruit 8y ago

I really do hate that many websites/services put a max length on passwords that is really short like 16.I remember even outlook.com restricting it to 16 chars,really bad for people who would use long sentence like passwords.

josefresco 8y ago

This was posted here a few years back, and it's still a tool I use: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-pass... Anyone else still using this?

hyperpape 8y ago

While I use strong passwords (better safe than sorry), how important is it really to worry about this kind of offline attack if you don't reuse passwords?

danShumway 8y ago

Outside of the Twitter-verse, who actually advocates to use a 3 word passphrase? Use 5 or 6 words and the problems listed here vanish. Also, use diceware or an equivalent generator. If you're writing out a string of letters and characters, that's not going to be random either. The only way to generate a random password is to use a device that gives you random numbers. If you're relying on your working vocabulary and picking passphrases out of thin air, then your 12 character letters, numbers, and symbols isn't going to very good either, because you're not good at choosing things randomly and picking letters out of thin air won't be any better than words. This entire article could be rewritten as one sentence: "Use a program or a dictionary/dice to generate your >4 word passphrase."

jarfil 8y ago
It doesn't even have to be truly random, just "random enough". If you were to use a passphrase like "Use 5 or 6 words and the problems listed here vanish", that wouldn't be random per se, but for an attacker it might as well be.

scotchio 8y ago

Quickly just sharing: I must have read online for 2 solid years about how much better/safer and secure Password Managers are before I finally switched to one. After switching though, the CONVENIENCE of a password manager is the most undersold part of it. Nothing seems to be perfect solution with security, but if you're reading this and haven't switched to a password manager for whatever reason, security benefits aside I would highly recommend finally doing it.

SketchySeaBeast 8y ago
> CONVENIENCE of a password manager Absolutely. The only issue I have is when I'm logging into something I log into every day, but other than that it's great to log into the manager and go "ah, here's the password I set up a decade ago".

dominicr 8y ago

I think this misses who the intended audience of this simple password advice is. Hint: it's not us. Normal people's passwords are terrible! It's the site name, their name, "password123" or a single word with a number on the end. A lot of advice about passwords is aimed at getting normal people to make easy steps to make their passwords better, not perfectly uncrackable. Complex passwords don't work for lay users and most of them aren't going to switch to password managers. So getting people to make small steps, like not reusing the same password and making it more than one word and a number, does make a big difference to users' security.

jlmcgraw 8y ago

I wrote a perl script a while back to create random passphrases based on a random mnemonic word It seems like a good idea to me but I’m not knowledgeable enough about cryptography to know if that’s really true and would be very interested to hear from anyone who does know https://github.com/jlmcgraw/mnemonic_passphrase https://github.com/jlmcgraw/mnemonic_passphrase

mcstafford 8y ago

Here's a sample from my 4x dictionary-based generator. Let me know how quickly you can re-create it via brute force. Pocahontas-ballot-balustrade-blackouts https://www.xkcd.com/936/ https://www.xkcd.com/936/

norswap 8y ago

I believe it comes from a good place, but this post is bad. Why? Because it doesn't apply the same comparison standard to character-based passwords than to word-based passwords. Sure, we only use a few common dictionary words. But by the same token, our character-based passwords aren't random strings either: they are variation based on random words. This is the basis of the xkcd advice to use 4 random words: https://xkcd.com/936/ https://xkcd.com/936/ Notice Randall gives each word 11 bits of entropy, meaning he considers each word is chosen at random amongst a pool of ~2000 words. Yet that base is still much bigger than ~64 for characters. If you take 3 common words, you get ~8 billion possibilities. 4 common words: 17,000 billion. That's much more than than ~400 billion for a perfectly random (again: that's not the case in practice) password of 12 characters. And four words is easy to remember, 12 random characters is HARD. If anything bad can be said about the xkcd comic, it's that it doesn't hammer the point that it has to be FOUR words. As three is much less secure (but still probably more secure than the 12 characters password people are likely to use in practice).

drbawb 8y ago
This post also fails to take into account people's exposure to fiction. My vocabulary may be limited, but many of my passphrases use nouns/concepts/slang that are drawn from video games, novels, movies, etc. Some of these works (authored by family, friends, and myself) aren't even published. I reckon the chance of these "words" being included in some cracker's dictionary is quite close to zero. Also as you point out their analysis of the entropy of random words is quite uncharitable. It fails to account for any sort of punctuation, capitalization, etc. Is my password "correct horse battery staple" or "correct Horse, battery staple!" or "CORRECT HORSE! Battery staple.", etc. There is a lot of entropy inherent in crafting a phrase.
- norswap 8y ago
  The point being that even so it's already better while simultaneously being easier to remember (because indeed, what did I capitalize again?).

atoponce 8y ago

Niceware ships 65,536 unique words. 3 words chosen randomly is 1 "password" of 281,474,976,710,656 possibilities. https://diracdeltas.github.io/niceware https://diracdeltas.github.io/niceware If that password was hashed with a single pass of vanilla MD5, the Jeremi Gonsey's cluster of 8 Nvidia GTX 1080i GPUs [2] would be running at 307,200,000,000 hashes per second. https://gist.github.com/epixoip/ace60d09981be09544fdd35005051505 https://gist.github.com/epixoip/ace60d09981be09544fdd3500505... In order to exhaust half of the keyspace, so odds would be in the favor of the password cracker finding the original hash, they would need to search only 140,737,488,355,328 hashes. At 307.2 gigahashes per second, this would take approximately 458 seconds, or just under 8 hours using the Niceware list. However, jumping to 4 random words grows that time by a factor of 65,536, which means reaching 50% exhaustion would take approximately 1 full year. Moving to 5 randomly generated Niceware words, and it's impractical to attempt cracking the MD5 hash. Cherry-picking 3 words is a little dishonest for the discussion surrounding password security. The right "best answer" for password generation is to use a password manager, no argument there. And I don't know of any password generators that generate passphrases by default, Niceware, Diceware, or otherwise. But if a user wants a passphrase instead, I don't know of a security expert who would recommend 3 words.