3 ms·

You've got to remember that this comic came out at a time when password managers were not extremely common, and the general consensus for a "good" password look

You've got to remember that this comic came out at a time when password managers were not extremely common, and the general consensus for a "good" password looked something like this: X8woi$SD The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. But if you introduce some random numbers or special characters into the words, it's still easy to remember and type, but becomes much more difficult to crack.

nullc 2y ago
> introduce some random numbers or special characters into the words, it's still easy to remember and type If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy! If you do it automatically and in a way that has high entropy the result is a lot less memorable. Probably just adding an additional word adds more entropy at less memorability cost.
- thesuitonym 2y ago
  >If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
  - nullc 2y ago
    Attackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.
logifail 2y ago
> it's still easy to remember and type I think the "ah-ha" moment for me was realising that I needed neither to be able to remember nor to type my passwords. Once that happens, passwords like 5Ze2vz7AdDjWbXXq start to look great rather than awful :)
- thesuitonym 2y ago
  That is a much better password, but there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already.
  - logifail 2y ago
    > there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already Right, but the whole point is that the (hopefully) one-time pain of doing this is worth it in the long run.
zokier 2y ago
> The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. Why you think that is "wrong"? It's the whole idea behind passphrases to consider each word as a symbol, and it's also what the xkcd entropy calculation is based on.

nullc 2y ago

> introduce some random numbers or special characters into the words, it's still easy to remember and type If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy! If you do it automatically and in a way that has high entropy the result is a lot less memorable. Probably just adding an additional word adds more entropy at less memorability cost.

thesuitonym 2y ago
>If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
- nullc 2y ago
  Attackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.

logifail 2y ago

> it's still easy to remember and type I think the "ah-ha" moment for me was realising that I needed neither to be able to remember nor to type my passwords. Once that happens, passwords like 5Ze2vz7AdDjWbXXq start to look great rather than awful :)

thesuitonym 2y ago
That is a much better password, but there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already.
- logifail 2y ago
  > there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already Right, but the whole point is that the (hopefully) one-time pain of doing this is worth it in the long run.

zokier 2y ago

> The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. Why you think that is "wrong"? It's the whole idea behind passphrases to consider each word as a symbol, and it's also what the xkcd entropy calculation is based on.