5 ms·

One of the things I try very hard to drive home to people is that WPA2 uses a passphrase and not a password. I highly encourage people to use something like a

One of the things I try very hard to drive home to people is that WPA2 uses a passphrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans are pretty adept at remembering, and turning it into a direct mnemonic for a more complicated passphrase.

lotharbot 14y ago
The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.
- Buttons840 14y ago
  So throw an extra character in there somewhere.
- commandar 14y ago
  WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. More importantly, any variations in punctuation, capitalization, spacing, etc would make a precomputed table worthless while still making the passphrase far easier for a human to remember than a random string of 8 characters.
  - ghayes 14y ago
    > More importantly, any variations in punctuation, capitalization, spacing Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection. It's worth noting that if we stripped whitespaces (and possibly some other common "could go both ways" features), we may be able to encourage people to choose higher entropy passwords.
    - commandar 14y ago
      >Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). Then append a random character at the end. The point is that any variation whatsoever from what's included in the precomputed table renders the table useless while being easier to remember than a purely random string of characters.
  - lotharbot 14y ago
    > "variations in punctuation, capitalization, spacing" ... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on. From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of trying to create a new scheme for generating passwords like "mangle a movie quote", you're better off just using the xkcd method / passphra.se
    - commandar 14y ago
      >From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"? Any variation from what a precomputed table expects renders the table useless. >It's no better from a computer-guessable standpoint, either. Besides the increased key space that has to be attacked?
      - lotharbot 14y ago
        > "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?" I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish". If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than what you get from stringing 4 random words together. You can try to grow that keyspace by adding in variations, each of which will get you a few bits of entropy, but those variations come at the cost of memorability. It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it. If you want both entropy and memorability, use a randomly generated passphrase (via http://passphra.se http://passphra.se or by using dice and a dictionary) instead of piecemeal randomness-on-top-of-non-random-quotes strategies.
        commandar 14y ago
Jare 14y ago
Obligatory xkcd: http://xkcd.com/936/ http://xkcd.com/936/

lotharbot 14y ago

The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.

Buttons840 14y ago
So throw an extra character in there somewhere.
commandar 14y ago
WPA2 keys hash the passphrase and the SSID. The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result. I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal. More importantly, any variations in punctuation, capitalization, spacing, etc would make a precomputed table worthless while still making the passphrase far easier for a human to remember than a random string of 8 characters.
- ghayes 14y ago
  > More importantly, any variations in punctuation, capitalization, spacing Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). This is the exact reason I've had a hard time with long pass-phrases and often generate a unique string and rely on physical protection. It's worth noting that if we stripped whitespaces (and possibly some other common "could go both ways" features), we may be able to encourage people to choose higher entropy passwords.
  - commandar 14y ago
    >Alternatively, exact spacing, punctuation, etc. limits the human advantage of remembering phrases ("Wait, was that a capital A before the comma? Do you use two spaces between the sentences?"). Then append a random character at the end. The point is that any variation whatsoever from what's included in the precomputed table renders the table useless while being easier to remember than a purely random string of characters.
- lotharbot 14y ago
  > "variations in punctuation, capitalization, spacing" ... have the same problem as a random string of characters. You have to remember which letter it was you capitalized, where you put the semicolon in place of the comma, and so on. From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. It's no better from a computer-guessable standpoint, either. So instead of trying to create a new scheme for generating passwords like "mangle a movie quote", you're better off just using the xkcd method / passphra.se
  - commandar 14y ago
    >From a human-memorable standpoint, that's no better than using an actually randomly generated passphrase. Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"? Any variation from what a precomputed table expects renders the table useless. >It's no better from a computer-guessable standpoint, either. Besides the increased key space that has to be attacked?
    - lotharbot 14y ago
      > "Are you seriously arguing that "The quick brown fox Jumps over the lazy dog!" is less human-memorable than "dlLejs$sAgkCnzklS%9sxckAAnvk"?" I didn't say "password", I said "passphrase". Something like "breath red long provide" or "itself even willing establish". If you're using memorable movie quotes or Shakespeare quotes or anything else that you could find on wikiquote, your keyspace is going to be smaller than what you get from stringing 4 random words together. You can try to grow that keyspace by adding in variations, each of which will get you a few bits of entropy, but those variations come at the cost of memorability. It's counterproductive to start with a non-random phrase like a quote, and then try to add randomness on top of it. If you want both entropy and memorability, use a randomly generated passphrase (via http://passphra.se http://passphra.se or by using dice and a dictionary) instead of piecemeal randomness-on-top-of-non-random-quotes strategies.
      - commandar 14y ago

Jare 14y ago

Obligatory xkcd: http://xkcd.com/936/ http://xkcd.com/936/