4 ms·

You're assuming that a) a passphrase is acceptable to the system/app and b) that people can competently pick words for a passphrase. That damn XKCD is overly s

You're assuming that a) a passphrase is acceptable to the system/app and b) that people can competently pick words for a passphrase. That damn XKCD is overly simplified at best. I really wish people would stop linking to it.

Toutouxc 4y ago
Please elaborate, how can you pick bad words for a passphrase? (Except obviously a movie title or an everyday sentence) Like, if I go "street bologna drawer sunset fang", did I do well?
- artisticnuke 4y ago
  Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think. Completely random choice of words is good, but it is not feasible to remember random passphrases for all of your accounts. Other common methods include appending a particular character to each word or alternate words...creating a pattern of sort, but this again makes it difficult to remember, which was the reason why we preferred passphrases instead of passwords in first place.
  - aurantia 4y ago
    > Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think. In English. Not all books in all languages ever published are "somewhere out there".
    - kadoban 4y ago
      > Not all books in all languages ever published are "somewhere out there". I mean, they mostly are or can be. What's the point on relying on "nobody happened to catalog the book I copied my passphrase from"? Are you going to check every week that nobody uploaded it to an archive site? There's easier schemes that don't rely on that.
      - aurantia 4y ago
        For smaller languages the steps would be: - Somebody would have to digitize an old book without mistakes. - Somebody would have to publish it online. - Somebody would have to scrape and archive that. - Somebody would have to transliterate it to Latin script. - That transliteration would also have be the same transliteration I'm using. It's unlikely it will be done for a lot of languages. > There's easier schemes that don't rely on that. Remembering random words is hard. This is how we got into this in the first place.
        kadoban 4y ago
        > Remembering random words is hard. This is how we got into this in the first place. It's really not. You just make a story out of it. My memory is quite crap, I'm still able to remember the ~3 passphrases I actually need, and I'm able to rotate them as required.
- kadoban 4y ago
  There's some things that are obviously bad: popular movie quotes, slightly less bad (but still bad): any quote from anything ever produced in any medium. Some things that are obviously good (you can calculate the entropy easily): diceware style schemes, generated with dice or a secure random generator. Anything in the middle it's quite hard to say. Humans are really bad at being random, so words you pick out of your head I'd be fairly suspicious of. But it's hard to prove it's a bad idea.
  - sirsuki 4y ago
    Considering length is key in computing “strength” I’m curious how using a long dialog from a movie might make it bad? Presuming you account for the full 95 entropy set (numbers, upper/lower letters, special characters) and padding¹ then how would an attacker know that a failed phrase failed because it was the wrong phase or because they forget to add some padding that is still unknown. From a dictionary/rainbow table perspective I'm curious how they would know to include the following in their lookup tables before going fill number crunching mode: TO be or NOT two be - that is the question!!!!!!!!!!7872665398 Bitwarden suggests this is strong as does GRC Haystacks¹ thoughts? ¹ https://www.grc.com/haystacks.htm https://www.grc.com/haystacks.htm ² https://bitwarden.com/password-strength/ https://bitwarden.com/password-strength/
    - kadoban 4y ago
      The only entropy that has is: 1) the choice of quote. Say that's in the top ten quotes ever, so something like 3 or so bits of entropy. 2) the modifications and additions to the quote. Really depends what the scheme is, but few bits for which words are capitalized (~4), few bits for where the hyphen is (~3), few bits for how many bangs (~4), and a bunch of bits for which number goes on the end, (~30ish). Some bits to account for the scheme itself and its choices too, but I don't know how to put a number on that. Do you see how little is actually coming from the quote? Your passphrase might as well just be "95!!!!78726653980" and if anything that's _easier_ to remember. Compare against something like a diceware passphrase. _All_ of the entropy comes from the passphrase part, the part that's easy to remember and trivial to calculate how secure it is. So a quote is bad because you can _make_ it secure, but you making it secure is just throwing crap at it until it's no longer functionally a quote in any real way. It's secure the same way a blank password is.
mmiyer 4y ago
Bitwarden also allows you to generate a random passphrase, which is pretty nice for those situations where you want to be able to manually type in the password.
lrem 4y ago
Bitwarden generates good pass phrases though.

Toutouxc 4y ago

Please elaborate, how can you pick bad words for a passphrase? (Except obviously a movie title or an everyday sentence) Like, if I go "street bologna drawer sunset fang", did I do well?

artisticnuke 4y ago
Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think. Completely random choice of words is good, but it is not feasible to remember random passphrases for all of your accounts. Other common methods include appending a particular character to each word or alternate words...creating a pattern of sort, but this again makes it difficult to remember, which was the reason why we preferred passphrases instead of passwords in first place.
- aurantia 4y ago
  > Popular movie quotes or lines from books with minor iterations are bad choices. They are somewhere out there and not as safe as one might think. In English. Not all books in all languages ever published are "somewhere out there".
  - kadoban 4y ago
    > Not all books in all languages ever published are "somewhere out there". I mean, they mostly are or can be. What's the point on relying on "nobody happened to catalog the book I copied my passphrase from"? Are you going to check every week that nobody uploaded it to an archive site? There's easier schemes that don't rely on that.
    - aurantia 4y ago
      For smaller languages the steps would be: - Somebody would have to digitize an old book without mistakes. - Somebody would have to publish it online. - Somebody would have to scrape and archive that. - Somebody would have to transliterate it to Latin script. - That transliteration would also have be the same transliteration I'm using. It's unlikely it will be done for a lot of languages. > There's easier schemes that don't rely on that. Remembering random words is hard. This is how we got into this in the first place.
      - kadoban 4y ago
        > Remembering random words is hard. This is how we got into this in the first place. It's really not. You just make a story out of it. My memory is quite crap, I'm still able to remember the ~3 passphrases I actually need, and I'm able to rotate them as required.
kadoban 4y ago
There's some things that are obviously bad: popular movie quotes, slightly less bad (but still bad): any quote from anything ever produced in any medium. Some things that are obviously good (you can calculate the entropy easily): diceware style schemes, generated with dice or a secure random generator. Anything in the middle it's quite hard to say. Humans are really bad at being random, so words you pick out of your head I'd be fairly suspicious of. But it's hard to prove it's a bad idea.
- sirsuki 4y ago
  Considering length is key in computing “strength” I’m curious how using a long dialog from a movie might make it bad? Presuming you account for the full 95 entropy set (numbers, upper/lower letters, special characters) and padding¹ then how would an attacker know that a failed phrase failed because it was the wrong phase or because they forget to add some padding that is still unknown. From a dictionary/rainbow table perspective I'm curious how they would know to include the following in their lookup tables before going fill number crunching mode: TO be or NOT two be - that is the question!!!!!!!!!!7872665398 Bitwarden suggests this is strong as does GRC Haystacks¹ thoughts? ¹ https://www.grc.com/haystacks.htm https://www.grc.com/haystacks.htm ² https://bitwarden.com/password-strength/ https://bitwarden.com/password-strength/
  - kadoban 4y ago
    The only entropy that has is: 1) the choice of quote. Say that's in the top ten quotes ever, so something like 3 or so bits of entropy. 2) the modifications and additions to the quote. Really depends what the scheme is, but few bits for which words are capitalized (~4), few bits for where the hyphen is (~3), few bits for how many bangs (~4), and a bunch of bits for which number goes on the end, (~30ish). Some bits to account for the scheme itself and its choices too, but I don't know how to put a number on that. Do you see how little is actually coming from the quote? Your passphrase might as well just be "95!!!!78726653980" and if anything that's _easier_ to remember. Compare against something like a diceware passphrase. _All_ of the entropy comes from the passphrase part, the part that's easy to remember and trivial to calculate how secure it is. So a quote is bad because you can _make_ it secure, but you making it secure is just throwing crap at it until it's no longer functionally a quote in any real way. It's secure the same way a blank password is.

mmiyer 4y ago

Bitwarden also allows you to generate a random passphrase, which is pretty nice for those situations where you want to be able to manually type in the password.

lrem 4y ago

Bitwarden generates good pass phrases though.