4 ms·

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password

• rogerbinns 14y ago
  Do I get to cite this http://xkcd.com/936/ http://xkcd.com/936/
• peeters 14y ago
  Well, you obviously have to define "long" and "any" in that sentence. The famous xkcd cartoon evaluates a four word "phrase" (four common random words) as 44 bits of entropy. But he's not comparing it to a random alpha-numeric string, he's comparing it to taking an uncommon word and doing a couple of letter substitutions to defeat complexity requirements. A real random alpha-numeric password (what I get my password manager to generate, since I don't have to remember it) 12 characters long is more like 70 bits of entropy. You'd need 6 random words to match that. Essentially for every 2 random alphanumeric characters you need another random word.
• DrJosiah 14y ago
  No. And preliminary research suggests that they are easier to crack. http://arstechnica.com/security/2013/01/grammar-badness-makes-cracking-harder-the-long-password/ http://arstechnica.com/security/2013/01/grammar-badness-make... Legitimately randomly generated passwords still win, as long as the server uses a salt with bcrypt or iterated hashing like PBKDF1 or PBKDF2.
• DanBC 14y ago
  Properly chosen pass phrases are very strong. Most people cannot properly chose a pass phrase. Use something like Diceware to generate a phrase.
• dlitz 14y ago
  If you read 128 bits of data from /dev/urandom, and then map the result to a space of 2128 possible passwords, then it doesn't actually matter what the possible passwords are, as long as it's a one-to-one mapping.