5 ms·

Why can't hackers just brute-force word combinations? If there are 170k English words, and 95 possible password characters, then it seems to me that 170,000^3 ~

by fwipsy 5y ago

Why can't hackers just brute-force word combinations? If there are 170k English words, and 95 possible password characters, then it seems to me that 170,000^3 ~= 95^8 so a 3-word English phrase would only be about as safe as an 8-character random string.

kazinator 5y ago
But, that is formidable: using three dictionary words, you have something that is as secure as 8 characters, those being chosen from the full set of 95 non-blank ASCII glyphs! It's likely way easier to memorize, not to mention type. Though, by the same lexical token, it's worth acknowledging that words from a 170,000 dictionary will include some difficult ones that are not in the user's vocabulary. Say we use a 30,000 dictionary of common words, and make the password four words. You know, like correct-horse-battery-staple. Wow, I remembered that.
- vlovich123 5y ago
  If you need one password, yes. However, most people have accounts on hundreds of sites. And you’re supposed to not reuse. That means you have to remember a unique combination of N words per site. I’m not convinced this is any better than choosing a 20-32 digit password from a secure RNG and storing it in a password manager.
  - jjk166 5y ago
    This is for people not using a password manager. Good luck coming up with and remembering hundreds of random 20 character alphanumeric sequences.
    - rainonmoon 5y ago
      Reusing a complex password (especially in multiple places) is almost as bad as using a weak password, but that seems inevitable given all the accounts a person uses these days if they refuse to use a password manager. In other words, do you think you'll have better luck remembering hundreds of three-word phrases? Or will you reuse your phrase everywhere and make yourself vulnerable?
      - jjk166 5y ago
        Yes, it is definitely easier to remember hundreds of three word phrases. If you know the lyrics to stairway to heaven, you can remember a little under 1000 unique three word phrases. How many song lyrics, movie quotes, pieces of trivia, names, etc can you recall? The human mind is well optimized for compressing and storing phrases composed of words, as opposed to random alphanumeric sequences.
        kazinator 5y ago
        Randomly chosen three word combinations are not "phrases" in the linguistic sense, though they certainly are "pass phrases". I think we are sliding into equivocation over multiple meanings of the word "phrase". There is a difficulty there that should be acknowledged.
      - kazinator 5y ago
        > remembering hundreds of three-word phrases For that, I'd strongly recommend simplifying your life to a dependency on fewer than 10 password-protected sites. (Or, for Pete's sake, at least try to keep it to "a few dozen", not "hundreds".) If you have hundreds of passwords, how many of those are critically important? I bet you could partition all those accounts into two groups: fewer than 10 that are important, and the rest. The passwords for the rest group could be heavily reused. Like, you know that password you created on some blog site three years ago (which for some reason didn't support Google or Facebook login) just to write one comment? Who cares about it.
  - kazinator 5y ago
    Ah, but one big reason people use password manager programs is that the passwords are simply too awkward to type by hand. If you have passwords which you can easily touch type, because they are just words, then your password manager can be a 3x4 card in your wallet. That card, rather than revealing the passwords, can just use some sort of shorthand mnemonics that only mean something to you. For instance, "correct battery horse staple" could just be noted down as a "CBHS", or some other idea. Typable passwords are useful with any sort of manager that doesn't enter passwords for you. E.g. a hardware device with a display that just shows you the password. Such a thing will work in circumstances when you're not able to run your password manager for whatever reason.
Uehreka 5y ago
Most people’s passwords are 10-ish character not-totally-random strings, so that would actually be an improvement. Now bump it to four words like the xkcd comic actually says and you’ve got a stew goin’.
btheshoe 5y ago
Yeah, just a pure word combination probably isn't enough. However, if you add in a little leatspe4k and maybe some dashes-between-words and a cApitalization or two the number of possible combinations skyrockets and the password stays pretty easy to remember

by fwipsy 5y ago

kazinator 5y ago

But, that is formidable: using three dictionary words, you have something that is as secure as 8 characters, those being chosen from the full set of 95 non-blank ASCII glyphs! It's likely way easier to memorize, not to mention type. Though, by the same lexical token, it's worth acknowledging that words from a 170,000 dictionary will include some difficult ones that are not in the user's vocabulary. Say we use a 30,000 dictionary of common words, and make the password four words. You know, like correct-horse-battery-staple. Wow, I remembered that.

vlovich123 5y ago
If you need one password, yes. However, most people have accounts on hundreds of sites. And you’re supposed to not reuse. That means you have to remember a unique combination of N words per site. I’m not convinced this is any better than choosing a 20-32 digit password from a secure RNG and storing it in a password manager.
- jjk166 5y ago
  This is for people not using a password manager. Good luck coming up with and remembering hundreds of random 20 character alphanumeric sequences.
  - rainonmoon 5y ago
    Reusing a complex password (especially in multiple places) is almost as bad as using a weak password, but that seems inevitable given all the accounts a person uses these days if they refuse to use a password manager. In other words, do you think you'll have better luck remembering hundreds of three-word phrases? Or will you reuse your phrase everywhere and make yourself vulnerable?
    - jjk166 5y ago
      Yes, it is definitely easier to remember hundreds of three word phrases. If you know the lyrics to stairway to heaven, you can remember a little under 1000 unique three word phrases. How many song lyrics, movie quotes, pieces of trivia, names, etc can you recall? The human mind is well optimized for compressing and storing phrases composed of words, as opposed to random alphanumeric sequences.
      - kazinator 5y ago
        Randomly chosen three word combinations are not "phrases" in the linguistic sense, though they certainly are "pass phrases". I think we are sliding into equivocation over multiple meanings of the word "phrase". There is a difficulty there that should be acknowledged.
    - kazinator 5y ago
      > remembering hundreds of three-word phrases For that, I'd strongly recommend simplifying your life to a dependency on fewer than 10 password-protected sites. (Or, for Pete's sake, at least try to keep it to "a few dozen", not "hundreds".) If you have hundreds of passwords, how many of those are critically important? I bet you could partition all those accounts into two groups: fewer than 10 that are important, and the rest. The passwords for the rest group could be heavily reused. Like, you know that password you created on some blog site three years ago (which for some reason didn't support Google or Facebook login) just to write one comment? Who cares about it.
- kazinator 5y ago
  Ah, but one big reason people use password manager programs is that the passwords are simply too awkward to type by hand. If you have passwords which you can easily touch type, because they are just words, then your password manager can be a 3x4 card in your wallet. That card, rather than revealing the passwords, can just use some sort of shorthand mnemonics that only mean something to you. For instance, "correct battery horse staple" could just be noted down as a "CBHS", or some other idea. Typable passwords are useful with any sort of manager that doesn't enter passwords for you. E.g. a hardware device with a display that just shows you the password. Such a thing will work in circumstances when you're not able to run your password manager for whatever reason.

Uehreka 5y ago

Most people’s passwords are 10-ish character not-totally-random strings, so that would actually be an improvement. Now bump it to four words like the xkcd comic actually says and you’ve got a stew goin’.

btheshoe 5y ago

Yeah, just a pure word combination probably isn't enough. However, if you add in a little leatspe4k and maybe some dashes-between-words and a cApitalization or two the number of possible combinations skyrockets and the password stays pretty easy to remember