5 ms·
https://xkcd.com/936/ https://xkcd.com/936/
by Bolkan 5y ago
https://xkcd.com/936/ https://xkcd.com/936/
- voiper1 5y agoInstructions unclear, password on all sites is now "correct horse battery staple". Inspired by this, there's a package https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn to estimate entropy and give suggestions.
- BoiledCabbage 5y agoFundamentally is there any flaw with this method? Or a reason why it isn't better than general password approach?
- kbart 5y agoIt's vulnerable to the dictionary-based attacks that are very common.
- rini17 5y agoThat is a sadly too often repeated lie. If you know otherwise please explain/link how the attack works, how can you guess the 4 words? Effectively, that would mean requiring much less than 2^44 attempts as xkcd explains.
- willis936 5y agoDiceware is designed to make passwords against dictionary attacks. Estimates of diceware entropy begin with the assumption that an attacker has the dictionary. A dictionary with 6^5 entries would take 6^5^N guesses to exhaust (assuming the entries are randomly chosen). 6^5^4 = 2^52.
- throwawayffffas 5y agoYou can only remember a limited number of passwords regardless of whether it's a sequence of words or a sequence of random characters. The main flaw in all these schemes is that you have to remember them. The only viable option is to use a password manager.