Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

paul.reviews

Post reply on HN
Print view View original

31–40 of 87 posts

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#31

Post by strictnein »

No, using 3 random words isn't "a really bad idea". That's complete nonsense.

The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online.

The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first place. Capitalize one random letter in all of that, throw a number between the second or third letter, add dashes, whatever and they're totally screwed. Game over, you win.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#32

Post by hyperpape »

mcphage wrote: post #15

This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first , then brute force.

If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n, because you share effort between the two schemes.

A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#33

Post by gregschlom »

gravy wrote: post #5

The ONE thing stopping me from using a password manager is fear that I'll lose the master password. How do I get over this fear? Another thing is for example Chrome's built in password manager. If I make a bunch of accounts with these passwords, do I NEED Chrome to ever be able to log in to these accounts?

Use the password manager for everything except your main email account. If you loose the password to the manager (which is also a good idea to write down somewhere), you can always recover all the other passwords individually as long as you have access to your email.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#36

Post by dwighttk »

strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

I think they are trying to point out that if "use three words" gets popular enough then it isn't good for any individual who does so.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#37

Post by copperx »

strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

> The only "really bad idea" for passwords is password reuse.

But is that really the ONLY "really bad idea" when using passwords?

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#39

Post by UncleMeat »

strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#40

Post by em-bee »

mcphage wrote: post #15

This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first , then brute force.

since testing for 3 or 4 random words is a lot cheaper than testing all combinations, the word test can be used first. it doesn't matter that the cracker knows which method you use, only that they make a good guess.

1: try lists of known stupid passwords

2: test for random words

3: brute force all character combinations

there should be a few more steps available, but just to give an idea.

if your password is from category 1, you'll drop first, and only of it is a sufficiently long password from category 3, or a longer version of category 2 will keep you safe.

one more things: a password with 8 random characters, and a password with 8 random words are equally easy to remember. because it's 8 items.

8 random words are longer to type, but much harder to crack than 8 random characters.

greetings, eMBee.

Post reply on HN