5 ms·

The XKCD comic assumes the attacker has 1000 guesses per second, but a single GPU box on a stolen hash can easily hit a couple billion guesses per second. So t

by nullc 2y ago

The XKCD comic assumes the attacker has 1000 guesses per second, but a single GPU box on a stolen hash can easily hit a couple billion guesses per second. So the security model of the comic is extremely optimistic compared to some completely reasonable and common threat models. Fortunately the readme on the target page appears to show the tool defaulting to passwords of considerably higher security than demonstrated in the comic which ought to provide reasonable security under a broader set of attack models.

littlestymaar 2y ago
From the comic: > (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.) And he's right (if you don't trust the website to hash the password securely, then you should assume your password is stored in plain text anyway)
- nullc 2y ago
  I do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)... and the stakes that users face has also involved in the time since the comic was written. E.g. I've seen people get burned using the comics advice for "brainwallets", which is equivalent to having a published unsalted hash. It's okay to have a confined security model, so long as you understand that's what you're doing. But users usually lack any real ability to gauge how likely password hashes are to leak just due to lack of information on how the sites operate. I think a better justification of the comic's original security level is that it's sufficient for protecting things where a compromise is only a nuisance, as is usually the case for 'random website'. But that isn't true for all password choices people make.
thesuitonym 2y ago
You've got to remember that this comic came out at a time when password managers were not extremely common, and the general consensus for a "good" password looked something like this: X8woi$SD The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. But if you introduce some random numbers or special characters into the words, it's still easy to remember and type, but becomes much more difficult to crack.
- nullc 2y ago
  > introduce some random numbers or special characters into the words, it's still easy to remember and type If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy! If you do it automatically and in a way that has high entropy the result is a lot less memorable. Probably just adding an additional word adds more entropy at less memorability cost.
  - thesuitonym 2y ago
    >If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
    - nullc 2y ago
      Attackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.
- logifail 2y ago
  > it's still easy to remember and type I think the "ah-ha" moment for me was realising that I needed neither to be able to remember nor to type my passwords. Once that happens, passwords like 5Ze2vz7AdDjWbXXq start to look great rather than awful :)
  - thesuitonym 2y ago
    That is a much better password, but there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already.
Arch-TK 2y ago
The only places I use 6 phrase diceware passwords ((6^5)^6 combinations) is FDE. I control the KDF and configure it to take at least a second on the host I am using FDE on. Even if you take these modern KDFs and find a way to do them 1000000 times faster, thats still an average of 3.5 billion years to crack (assuming you know i used diceware, know my word list, and know how I have formatted the password). I think I'll be fine. Also, I use real dice. Let me know if I calculated that wrong. The calculation was: (6^5)^6 / 1000000 / 2 / 60 / 60 / 24 / 365 The constants: 6 - sides on a D6 5 - dice per phrase 6 - phrases 1000000 - checked passwords per second (super optimistic, unrealistic hardware, outside even government reach) 2 - half way through a hypothetical dictionary attack 60 - seconds per minute 60 - minutes per hour 24 - hours per day 365 - days per year
ta1243 2y ago
By your numbers, Tr0ub4dor&3 will be decoded instantly but the xkcd one will still take hours
BtM909 2y ago
The comic was published on August 10, 2011 ;-)

by nullc 2y ago

littlestymaar 2y ago

From the comic: > (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.) And he's right (if you don't trust the website to hash the password securely, then you should assume your password is stored in plain text anyway)

nullc 2y ago
I do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)... and the stakes that users face has also involved in the time since the comic was written. E.g. I've seen people get burned using the comics advice for "brainwallets", which is equivalent to having a published unsalted hash. It's okay to have a confined security model, so long as you understand that's what you're doing. But users usually lack any real ability to gauge how likely password hashes are to leak just due to lack of information on how the sites operate. I think a better justification of the comic's original security level is that it's sufficient for protecting things where a compromise is only a nuisance, as is usually the case for 'random website'. But that isn't true for all password choices people make.

thesuitonym 2y ago

You've got to remember that this comic came out at a time when password managers were not extremely common, and the general consensus for a "good" password looked something like this: X8woi$SD The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. But if you introduce some random numbers or special characters into the words, it's still easy to remember and type, but becomes much more difficult to crack.

nullc 2y ago
> introduce some random numbers or special characters into the words, it's still easy to remember and type If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy! If you do it automatically and in a way that has high entropy the result is a lot less memorable. Probably just adding an additional word adds more entropy at less memorability cost.
- thesuitonym 2y ago
  >If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
  - nullc 2y ago
    Attackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.
logifail 2y ago
> it's still easy to remember and type I think the "ah-ha" moment for me was realising that I needed neither to be able to remember nor to type my passwords. Once that happens, passwords like 5Ze2vz7AdDjWbXXq start to look great rather than awful :)
- thesuitonym 2y ago
  That is a much better password, but there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already.

Arch-TK 2y ago

The only places I use 6 phrase diceware passwords ((6^5)^6 combinations) is FDE. I control the KDF and configure it to take at least a second on the host I am using FDE on. Even if you take these modern KDFs and find a way to do them 1000000 times faster, thats still an average of 3.5 billion years to crack (assuming you know i used diceware, know my word list, and know how I have formatted the password). I think I'll be fine. Also, I use real dice. Let me know if I calculated that wrong. The calculation was: (6^5)^6 / 1000000 / 2 / 60 / 60 / 24 / 365 The constants: 6 - sides on a D6 5 - dice per phrase 6 - phrases 1000000 - checked passwords per second (super optimistic, unrealistic hardware, outside even government reach) 2 - half way through a hypothetical dictionary attack 60 - seconds per minute 60 - minutes per hour 24 - hours per day 365 - days per year

ta1243 2y ago

By your numbers, Tr0ub4dor&3 will be decoded instantly but the xkcd one will still take hours

BtM909 2y ago

The comic was published on August 10, 2011 ;-)