5 ms·

Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 Englis

• ajkjk 4y ago
  The XKCD method was always aware of that, the point is that it's more entropy anyway.
• xvector 4y ago
  The English dictionary has about 170k-1M words, and taking the log_2 of that gives us about 16-20 bits of entropy per word. Depending on implementation, we have anywhere from 80 to 100 bits of security. Even on the low end, it should take well over a decade if LastPass chose a good cryptographic hash function with a high iteration count. The problem is that no average person is gonna use a password that long to begin with.
  • nerdawson 4y ago
    I think the other problem is that when people are thinking up “random” words on their own, they aren’t pulling from the English dictionary. Common vocabulary is a much smaller set.
    • Ekaros 4y ago
      About 20 000 active words is my understanding. And then the words people pick from is likely from fraction of that.
      • prmoustache 4y ago
        You don't have to pick all words in the same language. Most people know at least 3 languages well enough. I often make passphrases out of 5 to 6 languages.
        • nerdawson 4y ago
          No, that’s highly unusual. Maybe people know a handful of greetings / numbers in other languages but I think you’re vastly overestimating the number of people capable of speaking more than one language.
          • prmoustache 4y ago
            Maybe that is the prism of living in europe.
      • Freaky 4y ago
        XKCD estimated 11 bits per "common word", corresponding to a dictionary of ~2000. But that's assuming even distribution across that dictionary, which isn't a reasonable thing to expect a human to do themselves. Diceware - an actual formalisation of the approach, including recommended means of generating the entropy and specific wordlists - uses 7776 words, for a shade under 13 bits each. EFF have a nice one - https://www.eff.org/dice https://www.eff.org/dice The recommended 6 words gives 77.5 bits of entropy per password. At Lastpass's current default iterations of 100k that's about 2^93 SHA256 operations to have better than even odds of breaking it. To put that into perspective, the Bitcoin mining network is reportedly hashing at 256 quintillion hashes per second right now. At that rate it would take on average 72 weeks to crack. One extra word bumps that up to 11 millennia, if that's a bit too tractable for comfort.
  • daneel_w 4y ago
    People using this scheme for memorable passwords will be sticking to a very narrow set of words. There are several psychological factors that can be exploited here. It's not a good password scheme unless you aim for 7-8 words minimum.
• nkrisc 4y ago
  It’s more secure than passwords the vast majority of people currently use.
• taneq 4y ago
  XKCD isn't saying that four dictionary words strung together is as strong as a 30-character random password. He's saying they're better than an 8-character password which must include at least one upper case and one lower case letter, one number, one symbol, one loud bird call and one soft squirrel noise.
• pwg 4y ago
  The point of the XKCD is not that the method is "secure" in an absolute sense. It is that it is a method for which the large group of people who would choose "Password0!" as their password [1] can use to create a password they can potentially remember, but such that the chosen password is "relatively" more secure than the basic alternative they would have otherwise chosen. [1] I.e. the far too common method of "pick a word, make one or two letters capitol, append a numeral, append a !".