4 ms·
One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to
by drcode 15y ago
One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to all your passphrases. In this case, the salt would be a short, traditional, hard to remember password that you re-use with every xkcd style password. It would be hard to remember, but you'd only need to memorize it once.
So if your personal salt is "@T#23a" you would use "@T#23a correct horse battery staple" on one website and "@T#23a giant bug transistor leech" on another website.
- cdavidcash 15y agoYou might want to read the cartoon again to see why this is useless, counterproductive advice.
- dsmithn 15y agoIf this kind of thing takes off, it will become easier for dictionary based password attacks. Using this advice would go a long way towards preventing this.
- AdamTReineke 15y agoEasier, yes, but not easy. A dictionary attack on 4 words is the same as brute forcing 4 letters except now instead of just 26 letters there are thousands. 2000^4 vs 26^4 = 35,000,000% more to check.
- xyzzyb 15y agoYes, but the salt could also be useful for sites that require passwords to include a number, a non alphanumeric character, etc.
- re_todd 15y agoThat is what I do, I have a 4 character personal salt, like "7Pd$", and put it in the middle of a lowercase word or phrase. Having a symbol, lowercase letter, uppercase number, and number will satisfy most password requirements. I use it on many sites, so it is easy to remember. It also makes it simple to write passwords down, e.g. "correct horse ^ battery staple" which means to me "correct horse 7Pd$ battery staple", but would not be useful to someone who saw it, since they don't know my personal salt. A combination of what xkcd said and a short personal salt that's easy to remember is probably best.