5 ms·
A dictionary attack? Are you kidding me? You don't know it's alphabetic, you don't know it's an actual English phrase, you don't know how long it is, you don'
by diminoten 13y ago
A dictionary attack? Are you kidding me?
You don't know it's alphabetic, you don't know it's an actual English phrase, you don't know how long it is, you don't basically know jack shit to be able to effectively use a dictionary attack against a password like that. You don't know it's a passphrase, basically.
- nwh 13y agoA phrase like that is very easy to crack actually. People have been cracking brain wallets in the Bitcoin world (think storing all your money behind a passphrase that anybody can access, madness!) with greater complexity than that. From the person in questions posts, they're trawling wikipedia, quote databases, movie scripts, anything you can imagine to find phrases that people might use for passwords. It seems to work too, judging by the number of times I've encountered this person saying "hey, that's me, I stole those!". The fact that there's google results for that phrase means it's a useless passphrase.
- dmix 13y agoIndeed, sure it's long(ish) but it's trivialized by the commonality of the words it contains.
- diminoten 13y agoIt's simply not, due to the fact that you don't know it's a passphrase. You know nothing about the password, you will never get to trying it.
- nwh 13y agoYou underestimate people. More often than not people will use a quote like the example in the parents post did. In a world of custom FPGA devices to crack passwords, it wouldn't take long.
- diminoten 13y agoOkay, than show me. Show me the algorithm that'd crack the password I just came up with.
- nwh 13y agoA forum scraper bot comes across this page: http://www.banjohangout.org/archive/251990/14 http://www.banjohangout.org/archive/251990/14 "You always find something in the very last place you look." Bamn.
- gnur 13y agohttp://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
- deleted 13y ago[deleted]
- kamjam 13y agoObligatory xkcd: http://xkcd.com/936/ http://xkcd.com/936/
- chrismonsanto 13y agoThat is one of my least favorite xkcd comics. It is very misleading. If the attackers knows that your password is constructed in this fashion, then it is trivial to track the password, as we've restricted the search space to a multiple of the number of common English words. The entropy argument only makes sense if the human readable strings are just as likely to be chosen as passwords as other random strings, which is not at all the case.
- caf 13y agoYou have completely missed the point of the comic, which is that if you choose 4 common English words at random, the entropy is surprisingly high. It isn't based on "human readable strings" at all. For example, my /usr/share/dict/american-english contains just shy of 100,000 words. A random word chosen from that set has 16.6 bits of entropy, and four randomly chosen words has over 66 bits of entropy. If anything, XKCD's comic is understating the entropy involved.
- quinnchr 13y agoExcept when people create phrases like that they aren't choosing random words from a dictionary, they're most likely choosing words from their own vocabulary which will be significantly less than 100k words. Additionally the distribution is not uniform, reducing entropy even further.
- belorn 13y agoEvery password require that the user choose randomly. Words, letters, numbers, pixels on a screen... All require randomness in choosing. This is why some websites assign passwords to users and do not allow users to pick their own custom passwords. The only safe passwords are those generated by machines. This does not mean that picking words to form a pass-phrase is less secure than picking letters to form a password.
- wielebny 13y agoIt's a known maxim, that's probably included in many sentence dictionaries.
- diminoten 13y agoShow me.
- chrislipa 13y agohttp://www.chessgames.com/~AylerKupp?kpage=35 http://www.chessgames.com/~AylerKupp?kpage=35 Crackers are using phrases from literature and the bible. Trawling the rest of the internet is not far behind.
- diminoten 13y agoI responded to this kind of argument here: https://news.ycombinator.com/item?id=6558509 https://news.ycombinator.com/item?id=6558509
- vitobcn 13y agoThere was an article on ArsTechnica just a few days ago about this type of passwords: http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...