Stop forcing arbitrary password rules
ryanwinchester.ca
Stop forcing arbitrary password rules
1–10 of 196 posts
Re: Stop forcing arbitrary password rules
#2Abstract: pls use https://github.com/dropbox/zxcvbn
Re: Stop forcing arbitrary password rules
#3I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless:
> chili dog monkey nutso
Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72.
A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standard dictionary of 1626 easily memorable english words with each password being a 12 word mnemonic phrase. 1626^12 ~= 12^128
Re: Stop forcing arbitrary password rules
#4Argh! The XKCD entropy comic. Back away slowly..
The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them.
The same problem tangentially applies to his suggested password schema to.
The problem is: as soon as you start using human word or pseudo words then your complexity decreases significantly.
With that said he has a point: password complexity schemas as employed by websites are not good enough. It should enforce length and complexity properly (not by saying "you must have these types of characters" but by really analysing the password).
I appreciate the UX problems involved there... but then we could push people towards using password managers and auto-generated passwords.
Summary: use a password manager and auto-generate complex passwords.
Re: Stop forcing arbitrary password rules
#5I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…
it's approximately 250000^4
If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that..
Re: Stop forcing arbitrary password rules
#6I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…
it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that ..
It's not quite like that - even if you don't try the more readily accessible combinations before the longer ones, but simply split your computational effort on each one in proportion (you'll find all of the 4 word ones have been tried when only 1/250000 of the 5 word ones have).
Not to mention that "chili dog monkey" are not exactly rare words and even a 10k word english dictionary would contain those.
Re: Stop forcing arbitrary password rules
#7I see this a lot now, with the proliferation of libraries that allow for arbitrary passwords. Possibly some form of systemic trickling down of bad practices into software with horrible consequences
"Your password must contain the seventh circle of hell, and a Taco Emoji"
Re: Stop forcing arbitrary password rules
#8I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standa…
XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak.
So to give an example, any natural language phrase like:
"I took a walk in a park" is easier to crack.
I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak:
Re: Stop forcing arbitrary password rules
#9totally agree. just to make things worse, the password rule on the client side sometimes does not agree with the one on the server side. XD
Re: Stop forcing arbitrary password rules
#10Argh! The XKCD entropy comic. Back away slowly.. The "4 common words" password meme was around a lot after that comic. However, such passwords are definitely not secure because a good dictionary attack will break it in hours. You do not have as much entropy as you think with them. The same problem tangentially applies to his suggested password schema to. The problem is: as soon as you start using human word or pseudo…
Can you explain why the XKCD scheme is weak to dictionary attacks?
Using the 2048 common words example from the comic, there would be 2048^4 = 1.8e13 four word combinations. I don't see any possible attack that's faster than brute-force here.