3 ms·

Anyone know what this table means: 1 word 0 2 words 0 3 words 0 4 words 3m 5 words 19d 6 words 405y

by scanr 11y ago

Anyone know what this table means: 1 word 0 2 words 0 3 words 0 4 words 3m 5 words 19d 6 words 405y 7 words 3My Does it mean that if your password contains only 4 words, it 3 minutes to crack regardless of the words? Is https://xkcd.com/936/ https://xkcd.com/936/ bad advice?

desantis 11y ago
This threw me off as well, I think you are suppose to use the first chart if your password was generated randomly and the second chart if you used words. I am not 100 percent sure though.
TheLoneWolfling 11y ago
That XKCD comic is good advice. But use a long enough passphrase. Also, he's being (very) conservative. In other words, he's assuming a very fast password cracker. Roughly speaking, he has a wordlist of ~8070 words, which works out to ~13 bits of entropy / word. Which implies at 3My to crack 7 words he's assuming ~26 trillion (!) password hashes per second. That's potentially realistic if you're using a fast hash - but you should be using something that's slow (and memory-constrained) for a password hash.
- DanBlake 11y ago
  Doesnt the english language consist of 500,000-1,000,000 words? * http://www.merriam-webster.com/help/faq/total_words.htm http://www.merriam-webster.com/help/faq/total_words.htm
  - TheLoneWolfling 11y ago
    Yes. But most of them are far too close to each other to remember easily. Or relatively not used words. It's (generally) easier to just use a longer passphrase and a shorter wordlist of only relatively common words.
deleted 11y ago
[deleted]
psykovsky 11y ago
That is how many time to break the answer to the security question, not the passwords. The security questions have a weaker hashing function.
001spartan 11y ago
The way password crackers work now, it is quite easy to crack passwords that are combinations of words, even with alphanumeric substitution. The best passwords are completely random, and 24+ characters.
Buge 11y ago
The xkcd is bad advice. It mentions 1000 guesses per second. In reality GPU crackers can do 100,000,000,000 guesses per second. https://hashcat.net/oclhashcat/ https://hashcat.net/oclhashcat/ You need to add another 2-3 words.

by scanr 11y ago

desantis 11y ago

This threw me off as well, I think you are suppose to use the first chart if your password was generated randomly and the second chart if you used words. I am not 100 percent sure though.

TheLoneWolfling 11y ago

That XKCD comic is good advice. But use a long enough passphrase. Also, he's being (very) conservative. In other words, he's assuming a very fast password cracker. Roughly speaking, he has a wordlist of ~8070 words, which works out to ~13 bits of entropy / word. Which implies at 3My to crack 7 words he's assuming ~26 trillion (!) password hashes per second. That's potentially realistic if you're using a fast hash - but you should be using something that's slow (and memory-constrained) for a password hash.

DanBlake 11y ago
Doesnt the english language consist of 500,000-1,000,000 words? * http://www.merriam-webster.com/help/faq/total_words.htm http://www.merriam-webster.com/help/faq/total_words.htm
- TheLoneWolfling 11y ago
  Yes. But most of them are far too close to each other to remember easily. Or relatively not used words. It's (generally) easier to just use a longer passphrase and a shorter wordlist of only relatively common words.

deleted 11y ago

[deleted]

psykovsky 11y ago

That is how many time to break the answer to the security question, not the passwords. The security questions have a weaker hashing function.

001spartan 11y ago

The way password crackers work now, it is quite easy to crack passwords that are combinations of words, even with alphanumeric substitution. The best passwords are completely random, and 24+ characters.

Buge 11y ago

The xkcd is bad advice. It mentions 1000 guesses per second. In reality GPU crackers can do 100,000,000,000 guesses per second. https://hashcat.net/oclhashcat/ https://hashcat.net/oclhashcat/ You need to add another 2-3 words.