5 ms·

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion; because it gives a false sense of security. There is potentially a lot le

by ErrantX 15y ago

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured. See lower in the thread) However; it is in the right direction - introducing some sort of extra entropy can invalidate that form of attack and make this as secure as XKCD suggests. What do I currently do? I take a reasonable length common word, do a string/number replacement as so: H4ck3r N3ws And then repeat it 3 or 4 times: H4ck3r N3ws H4ck3r N3ws H4ck3r N3ws H4ck3r N3ws For extra entropy mix it up: H4ck3r N3ws H4ck3r News H4cker News Hacker News That's a simple example - so long as you have a reasonably random scheme then it is not easy to test against, but is fairly simple to remember. Bingo :) (EDIT: for the down voter(s) note: XKCD specifically says random common words - obscure words are another matter)

darklajid 15y ago
> he can trivially test combinations of dictionary words in very short amount of time. Explain the reasoning behind this, please. Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). How many words are in there? How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase) How many for three? How many for four words?
- hesselink 15y ago
  The XKCD criticism of the 'bad' password has the same problems. How does the hacker know I have this kind of password (starting with a real english word, for example)?
  - darklajid 15y ago
    No, it doesn't have the same problem. It criticizes a particular way to choose passwords, leading to a result that seems 'secure' and even quite good to lots of people. One that easily satisfies braindead corporate password rules. The entropy given there is based on that way to choose a password and even explained, graphically. If you choose your password totally different and from different sets of characters, then the number will be off. That's not a surprise though?
- burgerbrain 15y ago
  In fact, even if the attacker: 1) Knows this scheme was used. 2) Knows the list of words you used. 3) Knows how many words you used. You will still have that amount of entropy. Diceware entropy values are calculated with all three of these assumptions already made.
- ErrantX 15y ago
  > Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note that XKCD says common words, which is easily missed) Our software has a test (which runs about third in its list of tests) which does dictionary combinations up to three words (two words is quite a commonly used password based on our statistics) with a dictionary size of <s>175,000</s>17,500. (Edit: sorry, apparently it is an order of magnitude smaller, I checked with one of the engineers :)) This includes English words plus a few commonly used foreign/slang terms. The hit rate on this is fairly high. (we crack document/windows passwords mainly) You could of course choose deliberately obscure words to invalidate this - but they aren't so easy to remember (so people will tend not to). If someone is going out of their way to secure a password, sure, you're going to hit a brick wall. But what every password scheme tends to forget is the "human factor" whereby people not concentrating on being secure will introduce attack vectors.
  - darklajid 15y ago
    I actually didn't ignore the 'common' limitation (and didn't downvote you - I'm actually interested how you come up with that). Follow-up questions: - What are the first tests, before this 3rd that tests for words? I assume tests for passwords of the first/left variety in the comic? Aren't they cheaper? - 'Up to three words' is reducing the exponent of possible combinations by one. Length/number of words is relevant Edit: Another issue. You say 'people forget the human factor', while you, yourself, propose something like '4 times Hack News with substitutions' as better. How is that including the 'human factor'?
    - ErrantX 15y ago
      <scrubbed answer> You know what; it's been so long since I played around with this stuff (it's even a separate company now, that we just consult for) that I'm way out of touch with my thought process :) You're right; there is nothing particularly wrong with the suggestion that makes it intrinsically very weak for most uses. I'd best stop commenting before I make a total mess :) Sorry.
bunchesofdonald 15y ago
The comic is already taking worst case scenario into account, that the cracker knows that your password is made of words and which dictionary you used to generate the password. In the comic he is using a 2048 word dictionary, which gives 11 bits of entropy per word (log2(2048)), with a password made up of four words that gives a total of 44 bits of entropy. But if we were to assume that the cracker knows nothing about our password, say other than it being all lowercase a-z, then we have an entropy per character of log2(26) or 4.7. For the phrase "correct horse battery staple", which has a length of 28, the bit entropy of that phrase, under those conditions is 4.7 * 28 = 131.6. Which is nearly to the point of the cracker being more likely to find a collision.
pavel_lishin 15y ago
> H4ck3r N3ws H4ck3r News H4cker News Hacker News Maybe you have an excellent memory, but I'd forget this in a week. "Now let's see, is it the third 'hacker' that has the 4 AND the 3 in it? Or the 2nd?"
- djackson 15y ago
  He's just removing the right-most letter/number swap in each iteration.
dpark 15y ago
> H4ck3r N3ws H4ck3r News H4cker News Hacker News This is a terrible idea. It's one thing to ask a person to remember which characters they replaced in a word. It's another thing entirely to ask them to remember three different ways they swapped characters. This is a recipe for having to brute-force your own password. It's also still not as secure as you might imagine. There's very little entropy added by swapping characters (even though I do it as well), because there are very few substitutions that people make. "Hacker News Hacker News Hacker News" is nearly as secure as your convoluted 3rd passphrase, but a lot easier to remember. The repeat-three-times thing is probably not great advice, either. If this became popular, it would be trivial to add this to brute-forcing code, and it doesn't add as much entropy as adding just one extra character. I don't think the XKCD suggestion is actually good, either. Open a book and pick a medium-length sentence. There's your passphrase: an n-gram chosen arbitrarily from the corpus of (probably) English literature containing mixed-case and punctuation. You've got a ton of entropy there.
- klipt 15y ago
  > You've got a ton of entropy there. Nope - http://news.ycombinator.com/item?id=2873474 http://news.ycombinator.com/item?id=2873474
  - dpark 15y ago
    Sorry, should have linked back to that myself. Still, 41 bits, while less than the 44 bits from the XKCD algorithm, is a lot more entropy than most passwords have.
lukeschlather 15y ago
>H4ck3r N3ws H4ck3r News H4cker News Hacker News You can add equivalent entropy just by adding a few random special characters, a number, and a letter. Personally, I prefer to type my passwords until I remember them. Therefore, my metric is "easy to type and hard to guess." If it's easy to type, I remember it via muscle memory, which is unbelievably better than trying to remember abstract symbols.
- deleted 15y ago
  [deleted]

by ErrantX 15y ago

darklajid 15y ago

> he can trivially test combinations of dictionary words in very short amount of time. Explain the reasoning behind this, please. Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). How many words are in there? How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase) How many for three? How many for four words?

hesselink 15y ago
The XKCD criticism of the 'bad' password has the same problems. How does the hacker know I have this kind of password (starting with a real english word, for example)?
- darklajid 15y ago
  No, it doesn't have the same problem. It criticizes a particular way to choose passwords, leading to a result that seems 'secure' and even quite good to lots of people. One that easily satisfies braindead corporate password rules. The entropy given there is based on that way to choose a password and even explained, graphically. If you choose your password totally different and from different sets of characters, then the number will be off. That's not a surprise though?
burgerbrain 15y ago
In fact, even if the attacker: 1) Knows this scheme was used. 2) Knows the list of words you used. 3) Knows how many words you used. You will still have that amount of entropy. Diceware entropy values are calculated with all three of these assumptions already made.
ErrantX 15y ago
> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note that XKCD says common words, which is easily missed) Our software has a test (which runs about third in its list of tests) which does dictionary combinations up to three words (two words is quite a commonly used password based on our statistics) with a dictionary size of <s>175,000</s>17,500. (Edit: sorry, apparently it is an order of magnitude smaller, I checked with one of the engineers :)) This includes English words plus a few commonly used foreign/slang terms. The hit rate on this is fairly high. (we crack document/windows passwords mainly) You could of course choose deliberately obscure words to invalidate this - but they aren't so easy to remember (so people will tend not to). If someone is going out of their way to secure a password, sure, you're going to hit a brick wall. But what every password scheme tends to forget is the "human factor" whereby people not concentrating on being secure will introduce attack vectors.
- darklajid 15y ago
  I actually didn't ignore the 'common' limitation (and didn't downvote you - I'm actually interested how you come up with that). Follow-up questions: - What are the first tests, before this 3rd that tests for words? I assume tests for passwords of the first/left variety in the comic? Aren't they cheaper? - 'Up to three words' is reducing the exponent of possible combinations by one. Length/number of words is relevant Edit: Another issue. You say 'people forget the human factor', while you, yourself, propose something like '4 times Hack News with substitutions' as better. How is that including the 'human factor'?
  - ErrantX 15y ago
    <scrubbed answer> You know what; it's been so long since I played around with this stuff (it's even a separate company now, that we just consult for) that I'm way out of touch with my thought process :) You're right; there is nothing particularly wrong with the suggestion that makes it intrinsically very weak for most uses. I'd best stop commenting before I make a total mess :) Sorry.

bunchesofdonald 15y ago

The comic is already taking worst case scenario into account, that the cracker knows that your password is made of words and which dictionary you used to generate the password. In the comic he is using a 2048 word dictionary, which gives 11 bits of entropy per word (log2(2048)), with a password made up of four words that gives a total of 44 bits of entropy. But if we were to assume that the cracker knows nothing about our password, say other than it being all lowercase a-z, then we have an entropy per character of log2(26) or 4.7. For the phrase "correct horse battery staple", which has a length of 28, the bit entropy of that phrase, under those conditions is 4.7 * 28 = 131.6. Which is nearly to the point of the cracker being more likely to find a collision.

pavel_lishin 15y ago

> H4ck3r N3ws H4ck3r News H4cker News Hacker News Maybe you have an excellent memory, but I'd forget this in a week. "Now let's see, is it the third 'hacker' that has the 4 AND the 3 in it? Or the 2nd?"

djackson 15y ago
He's just removing the right-most letter/number swap in each iteration.

dpark 15y ago

> H4ck3r N3ws H4ck3r News H4cker News Hacker News This is a terrible idea. It's one thing to ask a person to remember which characters they replaced in a word. It's another thing entirely to ask them to remember three different ways they swapped characters. This is a recipe for having to brute-force your own password. It's also still not as secure as you might imagine. There's very little entropy added by swapping characters (even though I do it as well), because there are very few substitutions that people make. "Hacker News Hacker News Hacker News" is nearly as secure as your convoluted 3rd passphrase, but a lot easier to remember. The repeat-three-times thing is probably not great advice, either. If this became popular, it would be trivial to add this to brute-forcing code, and it doesn't add as much entropy as adding just one extra character. I don't think the XKCD suggestion is actually good, either. Open a book and pick a medium-length sentence. There's your passphrase: an n-gram chosen arbitrarily from the corpus of (probably) English literature containing mixed-case and punctuation. You've got a ton of entropy there.

klipt 15y ago
> You've got a ton of entropy there. Nope - http://news.ycombinator.com/item?id=2873474 http://news.ycombinator.com/item?id=2873474
- dpark 15y ago
  Sorry, should have linked back to that myself. Still, 41 bits, while less than the 44 bits from the XKCD algorithm, is a lot more entropy than most passwords have.

lukeschlather 15y ago

>H4ck3r N3ws H4ck3r News H4cker News Hacker News You can add equivalent entropy just by adding a few random special characters, a number, and a letter. Personally, I prefer to type my passwords until I remember them. Therefore, my metric is "easy to type and hard to guess." If it's easy to type, I remember it via muscle memory, which is unbelievably better than trying to remember abstract symbols.

deleted 15y ago
[deleted]