3 ms·

Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel repla

Are you a password cracker? Do you have a password cracker database in front of you? Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common). Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol Tbh the best password he could have written would probably have been a sentence like I really should forgive my ex wife who I broke up with on May 23rd @ 8pm! https://xkcd.com/936/ https://xkcd.com/936/

saileshr 12y ago
Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)
- dubcanada 12y ago
  Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
  - itsybitsycoder 12y ago
    Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.
Someone1234 12y ago
> Are you a password cracker? Is that a job title? I have cracked passwords before, yes. > Do you have a password cracker database in front of you? Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks. > Tbh the best password he could have written would probably have been a sentence like As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters. Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).

saileshr 12y ago

Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_with_your_pa_w0rd https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)

dubcanada 12y ago
Alright then try words written in latin & random characters from different types of alphabets. ѣд学한☏ Seems pretty secure, but it's not over 8 characters... If UTF8 was better supported, you could do something like phone, snowman, snowman, pile of poo, phone. That's fairly easy to remember and next to impossible to guess.
- itsybitsycoder 12y ago
  Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.

Someone1234 12y ago

> Are you a password cracker? Is that a job title? I have cracked passwords before, yes. > Do you have a password cracker database in front of you? Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks. > Tbh the best password he could have written would probably have been a sentence like As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters. Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).