Xkcd Password Generator

#1

Post by preshing » Thu, Aug 11, 2011, 1:05 PM UTC

Re: Xkcd Password Generator

#2

Post by ck2 » Thu, Aug 11, 2011, 1:27 PM UTC

I've been doing this for years on sites that allow long passwords - "pass sentences" - but I also throw in a number or two.

Re: Xkcd Password Generator

#3

Post by mrspeaker » Thu, Aug 11, 2011, 1:28 PM UTC

He he, reminds me of the password generator I made concatenating 3 words from the list of the "500 most common passwords": http://www.mrspeaker.net/2009/01/09/make-secure-passwords/

The top 500 list has an awful lot of naughty words - so the phrases are pretty easy to remember ;)

Re: Xkcd Password Generator

#4

Post by buro9 » Thu, Aug 11, 2011, 1:28 PM UTC

ck2 wrote: post #2

I've been doing this for years on sites that allow long passwords - "pass sentences" - but I also throw in a number or two.

I've also been doing this for years, but with bits of my post code thrown in to fulfil those edqe cases where complexity requirements are needed.

Re: Xkcd Password Generator

#5

Post by jwingy » Thu, Aug 11, 2011, 1:30 PM UTC

ck2 wrote: post #2

I've been doing this for years on sites that allow long passwords - "pass sentences" - but I also throw in a number or two.

+1 (TM now I guess)

You could have four word phrases that are maybe only ~12 characters, which if there are only alphabetical characters in the password, are still very much crackable via GPU brute force (http://mytechencounters.wordpress.com/2011/04/03/gpu-passwor...)

Re: Xkcd Password Generator

#6

Post by adnam » Thu, Aug 11, 2011, 1:34 PM UTC

Such a password scheme provides much less than 44 "bits" of entropy. Considering the use of 4 randomly chosen words from the c.170000 english words in general use, means we can guess the paraphrase in around 2^22 tries - even less than "Tr0ub4d0r3&".

EDIT: I'm totally wrong, it's more like 2*10^22 ... oops!

Re: Xkcd Password Generator

#7

Post by TetOn » Thu, Aug 11, 2011, 1:37 PM UTC

adnam wrote: post #6

Such a password scheme provides much less than 44 "bits" of entropy. Considering the use of 4 randomly chosen words from the c.170000 english words in general use, means we can guess the paraphrase in around 2^22 tries - even less than "Tr0ub4d0r3&". EDIT: I'm totally wrong, it's more like 2*10^22 ... oops!

Wouldn't you first have to know that the passphrase consists of four randomly chosen words (eg not three, five, or eight)? To me, that's the underlying strength of the approach that the comic (!) is trying to highlight.

Re: Xkcd Password Generator

#8

Post by petenixey » Thu, Aug 11, 2011, 1:38 PM UTC

buro9 wrote: post #4

ck2 wrote: post #2

I've been doing this for years on sites that allow long passwords - "pass sentences" - but I also throw in a number or two.

I've also been doing this for years, but with bits of my post code thrown in to fulfil those edqe cases where complexity requirements are needed.

... random combinations of bike bits plus a greater London post code. Give me enough monkeys and typewriters and I could take you ;)

Re: Xkcd Password Generator

#9

Post by meentsbk » Thu, Aug 11, 2011, 1:38 PM UTC

adnam wrote: post #6

Such a password scheme provides much less than 44 "bits" of entropy. Considering the use of 4 randomly chosen words from the c.170000 english words in general use, means we can guess the paraphrase in around 2^22 tries - even less than "Tr0ub4d0r3&". EDIT: I'm totally wrong, it's more like 2*10^22 ... oops!

There is a really interesting discussion on using passphrases from stackexchange that is probably worth linking: http://security.stackexchange.com/questions/6095/xkcd-936-sh...

Re: Xkcd Password Generator

#10

Post by ErrantX » Thu, Aug 11, 2011, 1:42 PM UTC

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion; because it gives a false sense of security.

There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time.

(EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured. See lower in the thread)

However; it is in the right direction - introducing some sort of extra entropy can invalidate that form of attack and make this as secure as XKCD suggests.

What do I currently do? I take a reasonable length common word, do a string/number replacement as so:

H4ck3r N3ws

And then repeat it 3 or 4 times:

H4ck3r N3ws H4ck3r N3ws H4ck3r N3ws H4ck3r N3ws

For extra entropy mix it up:

H4ck3r N3ws H4ck3r News H4cker News Hacker News

That's a simple example - so long as you have a reasonably random scheme then it is not easy to test against, but is fairly simple to remember.

Bingo :)

(EDIT: for the down voter(s) note: XKCD specifically says random common words - obscure words are another matter)