5 ms·

Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it. > “The b

by ryan-c 11y ago

Snowden's passphrase[0] advice is pretty bad - perhaps they came up with a list of phrases based on what they know of him and successfully cracked it. > “The best advice here is to shift your thinking from passWORDs to passPHRASES,” Snowden recommended. “Think about a common phrase that works for you. It’s too long to brute force and also make them unlikely to be in the dictionary.” (emphasis mine) 0. http://rt.com/usa/248401-snowden-oliver-password-protection-advice/ http://rt.com/usa/248401-snowden-oliver-password-protection-...

programmernews3 11y ago
I expect Snowden actually advocates people use something like diceware passphrases and the journalist misunderstood. https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
- ryan-c 11y ago
  That sure isn't what he said to John Oliver. https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that. Diceware is a great choice.
anonbanker 11y ago
Perhaps you can come up with a reason why this is bad? While I'm asking, perhaps you can come up with a reason that doesn't boil down to "Bruce Schneirer said XKCD method was bad"?
- ryan-c 11y ago
  It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists. XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm. Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.

by ryan-c 11y ago

programmernews3 11y ago

I expect Snowden actually advocates people use something like diceware passphrases and the journalist misunderstood. https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware

ryan-c 11y ago
That sure isn't what he said to John Oliver. https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s https://www.youtube.com/watch?v=yzGzB-yYKcc#t=1m30s He mentioned "margrattethatcheris110%SEXY" - I would be totally unsuprised if someone managed to crack that. Diceware is a great choice.

anonbanker 11y ago

Perhaps you can come up with a reason why this is bad? While I'm asking, perhaps you can come up with a reason that doesn't boil down to "Bruce Schneirer said XKCD method was bad"?

ryan-c 11y ago
It's more that most humans are predictable most of the time. There's no reason a password cracking dictionary can't contain phrases as well, and most of the sorts of rules based permutations used against normal passwords can be extended to passphrases. Attacking a specific individual also tends to be easier - you can profile them and build targeted word and phrase lists. XKCD is bad specifically because it is specifically talking about attacking a password via an internet based oracle rather than attacking a hash, but people generalized it. A search space of ten or twenty trillion is laughable when a few GPUs can make a billions of guesses per second against a vanilla hash algorithm. Ultimately, if you want a password or passphrase that a computer can't guess, you should let a computer pick it for you, or if you're really paranoid, use diceware.