Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

paul.reviews

Post reply on HN
Print view View original

41–50 of 87 posts

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#41

Post by falcolas »

thebluehawk wrote: post #26
falcolas wrote: post #12

Earlier quoted context omitted.

To keep track of your master password, just write it down and put it in your wallet/purse. We're used to and experienced with securing physical objects, and while it still offers an avenue to expose all your passwords, it requires a lot of extra work to do so. Basically, storing your master password physically only really vulnerable to highly targeted attacks.

I would put it somewhere more secure than wallet/purse, unless you are forgetting your master password daily. I put mine in a place similar to a hidden folder in a filing cabinet. I haven't forgotten my master password yet, but I know that it's there if I need it.

I would imagine that anyone who is dedicated enough to violate your person to obtain your master password would also not hesitate to violate your house to obtain your master password (in fact, they may do so first).

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#43

Post by em-bee »

UncleMeat wrote: post #39
strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.

agreed, the threat of online passwords is a break-in revealing the password database which happens to be in plain text 'ooops!'

and even if the password list is not in plain text, but the attacker manages to find your 3-word password, if you didn't reuse that password any where else, then it can't be used to get into any of your other accounts.

and for the account for which they found your password, they already broke into that system, so no additional loss here either.

greetings, eMBee.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#44

Post by danShumway »

Outside of the Twitter-verse, who actually advocates to use a 3 word passphrase? Use 5 or 6 words and the problems listed here vanish. Also, use diceware or an equivalent generator.

If you're writing out a string of letters and characters, that's not going to be random either. The only way to generate a random password is to use a device that gives you random numbers. If you're relying on your working vocabulary and picking passphrases out of thin air, then your 12 character letters, numbers, and symbols isn't going to very good either, because you're not good at choosing things randomly and picking letters out of thin air won't be any better than words.

This entire article could be rewritten as one sentence: "Use a program or a dictionary/dice to generate your >4 word passphrase."

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#45

Post by palebluedot »

falcolas wrote: post #41
thebluehawk wrote: post #26

Earlier quoted context omitted.

I would put it somewhere more secure than wallet/purse, unless you are forgetting your master password daily. I put mine in a place similar to a hidden folder in a filing cabinet. I haven't forgotten my master password yet, but I know that it's there if I need it.

I would imagine that anyone who is dedicated enough to violate your person to obtain your master password would also not hesitate to violate your house to obtain your master password (in fact, they may do so first).

I think the concern is more that it is a lot easier to accidentally lose a wallet or purse (or have it stolen for unrelated reasons), rather than a targeted attack against your person for the master password.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#46

Post by daveFNbuck »

TotempaaltJ wrote: post #19
scblock wrote: post #6

I'm not sure how this made it to the front page. It mashes up several things about passwords, some of which are dangerous, some of which are smart. It acknowledges the strength of a system like diceware. Then it concludes 'Don't use words in passwords. Ever.' while failing to distinguish between passphases based on words (like diceware generates) and having a password that is "benisgreat".

Here's 1Password's article on creating a master password (spoilers: it is _way_ better): https://blog.1password.com/toward-better-master-passwords/

> Change a weak Master Password, otherwise leave it be

I wish LastPass would take this advice. They ask me to change my master password every time I log in because I've had the same one for a long time.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#47

Post by strictnein »

copperx wrote: post #37
strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

> The only "really bad idea" for passwords is password reuse. But is that really the ONLY "really bad idea" when using passwords?

True true. It's not the only one :)

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#48

Post by sidedishes »

jsgo wrote: post #29

Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning): 1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of tho…

To your first point, I think it's about priors about password choices. To take an extreme example, even if a site allows up to 32 alphanumeric characters, we don't just say passwords on this site are uniformly secure under metric (26+26+10)^32 because theoretically a brute-force approach would have to go through up that many permutations. (Such a number is an upper bound on your password security.)

In particular, short passwords with up to 8 characters are weaker because they form a small and common subset of passwords that people often draw from, and attackers exploit that by trying short passwords first.

Passwords that are 3 dictionary words, with possibly some small perturbations like punctuation inserts or replacements (which helps but only expands the space so much), also form a relatively small subset of passwords that people increasingly draw upon, and attackers aware of this will tailor their brute-force search accordingly.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#49

Post by gmuslera »

UncleMeat wrote: post #39
strictnein wrote: post #31

No, using 3 random words isn't "a really bad idea". That's complete nonsense. The only "really bad idea" for passwords is password reuse. A unique 14 character three word password for each site you use will protect you from the threats you face online. The fact that someone can relatively quickly crack your password if you used 3 random words is meaningless. That only works if they knew that you did that in the first…

Even if they know it doesn't matter. Online password brute force attacks are extremely rare. If you don't reuse passwords then offline attacks don't really matter to you.

This very week you had the Quora users info leak (https://blog.quora.com/Quora-Security-Update) where users info, including and their encrypted passwords, were compromised.

Password reuse, or even following a simple pattern for having different password for each site (i.e. a seed+site name) is the main problem here. If one site falls, then it should not be trivial to deduce your password or how to attack it for other, maybe more important or secure, sites.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#50

Post by falcolas »

palebluedot wrote: post #45
falcolas wrote: post #41

Earlier quoted context omitted.

I would imagine that anyone who is dedicated enough to violate your person to obtain your master password would also not hesitate to violate your house to obtain your master password (in fact, they may do so first).

I think the concern is more that it is a lot easier to accidentally lose a wallet or purse (or have it stolen for unrelated reasons), rather than a targeted attack against your person for the master password.

Well, the copy of it is just for backup purposes most times anyways, so the loss of the copy isn't going to be unrecoverable in most cases. And, as a bonus, you don't have to return home if you do forget it.

And, as I mentioned earlier, we're really quite good at keeping track of wallets and purses in the first case. Losing them is typically (at least in my own experience) a once-in-a-decade event.

Post reply on HN