According to XKCD[0] you need a fourth random word.
Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
11–20 of 87 posts
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#12The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
To keep track of your master password, just write it down and put it in your wallet/purse. We're used to and experienced with securing physical objects, and while it still offers an avenue to expose all your passwords, it requires a lot of extra work to do so.
Basically, storing your master password physically only really vulnerable to highly targeted attacks.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#13What I don't understand is the math. Author makes the claim that using 3 words changes the combinatorics from 62^12 (62 characters, in 12 positions) to 20,000^3 (20k words, in 3 positions) but a hashing algorithm doesn't work with words, it works with characters, so if the words are 4 characters each, you've still got 12 characters to fill. Since an attacker doesn't know that you've not used symbols or numbers, they can't reduce the problem space to 26^12. Right?
Have I missed something in the article that would make the connection?
EDIT: Yes, hashing works with bytes, so technically, it can be even stronger if we include charsets from other scripts in the problem space.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#14i hate this kind of pedantry. it just has to be better than what people currently use, which is stuff like password1, or 123456. yes, in an ideal world we would all use password managers, but that hasn't happened yet, either.
Yep, exactly this. Perfect is the enemy of good. This is like the people who argue against your nontechnical relatives writing down their passwords. In reality, if they do that and have unique passwords for all their accounts, they're actually doing really well!
The base comparison seems to be a mixed character password with a length of 14. That's far more complex than the vast majority of passwords out there, so the simple three word password would be significantly more "secure" than the average password used.
Password managers are relatively easy to setup for technical people, but getting everything working on your home pc, tablet, and phone isn't a simple task for many people.
The threat 99.999999% of us face isn't that someone will bruteforce our password using a Cray. The attack that is currently occurring against you and the people you know is credential stuffing, which simply targets password reuse.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#15This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first, then brute force.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#16The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
Write it down on paper, put it in an envelope, and leave it in your home, preferably in a small fire resistant lockbox that you keep other important documents in.
If your home isn't secure enough for this purpose due to roommates or other issues, ask a trusted friend, parent or relative to hold onto it and your other important documents on your behalf. If your situation makes putting it in someone else's hands a problem, you can split the password or other key material between multiple locations as well. 1Password makes it easy with the "rescue kit", and KeepassXC can use a combination of a password and file-based key for this purpose.
Security conversations on this topic typically go down some rabbit hole about the government, police etc. Keep it simple and don't crawl into that hole. End of the day, in the United States, the most reliable and legally secure place is your home or in some cases an attorney's office.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#17The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?
Writing your password down on paper seems reasonable. Personally I use something that I deem to be secure, which is a reasonably long, but memorable (for me) sentence, using a pretty large character set. Feel free to Math me wrong on that.
I use LastPass (seem to be in the minority here - there are definitely some things about it that bother me; never tried 1Password). Password manager has simplified my life. Not much any more do I have to wonder which password I used where, etc.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#18Yes, if you use 3 common words it's not a good idea.
But most people don't, and the attacker doesn't know that.
It's useless to use a strong password if it's going to be stored in plaintext on some service.
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#19I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".
Here's 1Password's article on creating a master password (spoilers: it is _way_ better): https://blog.1password.com/toward-better-master-passwords/
Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)
#20I guess this is a good primer for some folks, but there are two really spurious arguments:
(1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability).
(2) Faced with the suggestion of adding more words, they show that 4 is crackable. But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect. This article should be as simple as "use 5 random words, not 4".
Password managers have their own issues, both with usability and their tendency to provide centralized targets. And, they still require a secure passkey themselves -- for which a long random phrase is a perfectly reasonable approach.