Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

paul.reviews

Post reply on HN
Print view View original

51–60 of 87 posts

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#51

Post by jsgo »

sidedishes wrote: post #48
jsgo wrote: post #29

Novice in the area, so grain of salt (and if you can correct me where I'm wrong, that'd be great. All for learning): 1) I don't think the base changes nor the exponent deviates from the character approach (in reference to the 20,000, 40,000, and 171,000 base stated). If we're in a system that allows all uppercase letters, all lower case letters, all special characters, and all numbers, then the base is the sum of tho…

To your first point, I think it's about priors about password choices. To take an extreme example, even if a site allows up to 32 alphanumeric characters, we don't just say passwords on this site are uniformly secure under metric (26+26+10)^32 because theoretically a brute-force approach would have to go through up that many permutations. (Such a number is an upper bound on your password security.) In particular, sho…

I might be misunderstanding your first paragraph, but I'm not saying that the exponent is constant, just the base.

What I was saying is if the rules of the site allow for all lower, all upper, special characters, and numerals, the sum of that is your base. If your password is purplepenguinparade, the expectation is you've cracked it by the time you've completed combined_base^1 through combined_base^19. They could artificially limit it (most people use lowercase characters and this site allows just lowercase characters, so let's try 26^n), but they'd run the risk of never cracking it because characters could've been added that deviate from their parameters.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#52

Post by makomk »

mbreedlove wrote: post #4

I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages. An application using a memory-hard algorithm like bcrypt would yield the same results, but without the hassle of retraining all users to use longer passwords.

Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be expected to remember passwords strong enough to resist brute force at the speed we can achieve these days if they're just hashed with MD5, SHA1, or any of the other cryptographic hashes. That's true whether they're random words, random letters, or any other scheme you can think up.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#53

Post by mcphage »

hyperpape wrote: post #32
mcphage wrote: post #15

This depends on the cracker knowing that you only use words in your password. If they don't know that, then they're back to cracking it based on length. Or at least, attempting all of the words first , then brute force.

If you have n schemes that you’re targeting, that’s only a slowdown by a factor of n , because you share effort between the two schemes. A cracker can try all the word combinations below a certain depth, then try all the passwords below a certain depth. Then increase the search space a bit for each, as long as they want.

That's fine if your only other scheme is "exact matching words". But once you break from that, even a little bit, the number of different possible schemes balloons quickly. For instance, 3 words + a symbol at the end. A cracker can try all the words, sure. But they're probably not going to try every different "all the words plus a little twist" schemes.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#54

Post by scotchio »

Quickly just sharing:

I must have read online for 2 solid years about how much better/safer and secure Password Managers are before I finally switched to one.

After switching though, the CONVENIENCE of a password manager is the most undersold part of it.

Nothing seems to be perfect solution with security, but if you're reading this and haven't switched to a password manager for whatever reason, security benefits aside I would highly recommend finally doing it.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#55

Post by SketchySeaBeast »

scotchio wrote: post #54

Quickly just sharing: I must have read online for 2 solid years about how much better/safer and secure Password Managers are before I finally switched to one. After switching though, the CONVENIENCE of a password manager is the most undersold part of it. Nothing seems to be perfect solution with security, but if you're reading this and haven't switched to a password manager for whatever reason, security benefits asid…

> CONVENIENCE of a password manager

Absolutely. The only issue I have is when I'm logging into something I log into every day, but other than that it's great to log into the manager and go "ah, here's the password I set up a decade ago".

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#56

Post by SketchySeaBeast »

ritchiea wrote: post #9
scandox wrote: post #3

The simple answer here is to use non-word words. A sample might be: eggscellent frantillion scrofulon Ok. I'm skewing to the letter 'L' - but they don't have to know that.

You can also, add irregular punctuation & capitalization, throw in some numbers within words, include words from other languages that you know or look up. Or use near words of other languages. I have always thought of "3 random words" as a starting point for randomizing a password not literal advice to follow.

I wonder about that - given that a dictionary attack relies on known values (and can substitute out "l"'s for "1" and "!") - what happens if you write something like "Ger!bils"? Is the dictionary attack totally nullified, or is that possibly accounted for? That would seem to open up the potential space a ton.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#57

Post by dominicr »

I think this misses who the intended audience of this simple password advice is. Hint: it's not us.

Normal people's passwords are terrible! It's the site name, their name, "password123" or a single word with a number on the end.

A lot of advice about passwords is aimed at getting normal people to make easy steps to make their passwords better, not perfectly uncrackable.

Complex passwords don't work for lay users and most of them aren't going to switch to password managers. So getting people to make small steps, like not reusing the same password and making it more than one word and a number, does make a big difference to users' security.

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#58

Post by jlmcgraw »

I wrote a perl script a while back to create random passphrases based on a random mnemonic word

It seems like a good idea to me but I’m not knowledgeable enough about cryptography to know if that’s really true and would be very interested to hear from anyone who does know

https://github.com/jlmcgraw/mnemonic_passphrase

Re: Passwords: Using 3 Random Words Is a Really Bad Idea (2017)

#60

Post by closetohome »

evrydayhustling wrote: post #20

I guess this is a good primer for some folks, but there are two really spurious arguments: (1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability). (2) Faced with the suggestion…

> "use 5 random words, not 4"

But that would actually be useful, and get fewer hits.

Post reply on HN