5 ms·

There's an xkxd for this: https://xkcd.com/936/ https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the ti

by pajko 3y ago

There's an xkxd for this: https://xkcd.com/936/ https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.

Eric_WVGG 3y ago
There's an understated bonus to "correct horse battery staple" passwords — they're easier to type on iPhone and Android keyboards. So besides being of questionable security benefits, 0bScur3 passwords also bonk that advantage of nice-long-easy-to-remember passwords.
- jamesponddotco 3y ago
  Or on a PS5, Nintendo Switch, and whatnot. So much easier to type and remember.
  - tracker1 3y ago
    Yeah, streaming accounts are probably the only ones in my password manager that aren't randomly generated for that reason. "Gimme movies now!" (not my actual passphrase)
    - jamesponddotco 3y ago
      Mine are still randomly generated, but using the diceware method. Best of both worlds, really.
ckozlowski 3y ago
There was an arstechnica article a while back with a password cracker (person) who had an answer for this: https://arstechnica.com/information-technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ https://arstechnica.com/information-technology/2013/05/how-c... "The specific type of hybrid attack that cracked that password is known as a combinator attack. It combines each word in a dictionary with every other word in the dictionary. Because these attacks are capable of generating a huge number of guesses—the square of the number of words in the dict—crackers often work with smaller word lists or simply terminate a run in progress once things start slowing down. Other times, they combine words from one big dictionary with words from a smaller one. Steube was able to crack "momof3g8kids" because he had "momof3g" in his 111 million dict and "8kids" in a smaller dict. "The combinator attack got it! It's cool," he said. Then referring to the oft-cited xkcd comic, he added: "This is an answer to the batteryhorsestaple thing."" The entropy factors I see listed as in the xkcd comic are only valid if the cracking entity is doing a brute force attack. But skilled attacks won't be doing this. There's still nothing that beats a truly random string. But as others pointed out, it's also the most inconvenient to try to manage and remember.
- ndriscoll 3y ago
  The xkcd method is a truly random string with 44 bits in the example (4 words each chosen from a 2k dictionary). There is no better way to crack it than brute force. The words are just a rendering of a 44 bit random number. You could also render it as 44 digit binary number or an 11 digit decimal number or as an 8 digit base 64 string. It doesn't matter; it's still a 44 bit number and requires exactly as much work to crack.

by pajko 3y ago

There's an xkxd for this: https://xkcd.com/936/ https://xkcd.com/936/ And yet our infrastructure demands so obscure passwords I keep forgetting them all the time.

Eric_WVGG 3y ago

There's an understated bonus to "correct horse battery staple" passwords — they're easier to type on iPhone and Android keyboards. So besides being of questionable security benefits, 0bScur3 passwords also bonk that advantage of nice-long-easy-to-remember passwords.

jamesponddotco 3y ago
Or on a PS5, Nintendo Switch, and whatnot. So much easier to type and remember.
- tracker1 3y ago
  Yeah, streaming accounts are probably the only ones in my password manager that aren't randomly generated for that reason. "Gimme movies now!" (not my actual passphrase)
  - jamesponddotco 3y ago
    Mine are still randomly generated, but using the diceware method. Best of both worlds, really.

ckozlowski 3y ago

There was an arstechnica article a while back with a password cracker (person) who had an answer for this: https://arstechnica.com/information-technology/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/ https://arstechnica.com/information-technology/2013/05/how-c... "The specific type of hybrid attack that cracked that password is known as a combinator attack. It combines each word in a dictionary with every other word in the dictionary. Because these attacks are capable of generating a huge number of guesses—the square of the number of words in the dict—crackers often work with smaller word lists or simply terminate a run in progress once things start slowing down. Other times, they combine words from one big dictionary with words from a smaller one. Steube was able to crack "momof3g8kids" because he had "momof3g" in his 111 million dict and "8kids" in a smaller dict. "The combinator attack got it! It's cool," he said. Then referring to the oft-cited xkcd comic, he added: "This is an answer to the batteryhorsestaple thing."" The entropy factors I see listed as in the xkcd comic are only valid if the cracking entity is doing a brute force attack. But skilled attacks won't be doing this. There's still nothing that beats a truly random string. But as others pointed out, it's also the most inconvenient to try to manage and remember.

ndriscoll 3y ago
The xkcd method is a truly random string with 44 bits in the example (4 words each chosen from a 2k dictionary). There is no better way to crack it than brute force. The words are just a rendering of a 44 bit random number. You could also render it as 44 digit binary number or an 11 digit decimal number or as an 8 digit base 64 string. It doesn't matter; it's still a 44 bit number and requires exactly as much work to crack.