"For those of us pedantic enough to want a rule, here it is: The preferred form is "xkcd", all lower-case. In formal contexts where a lowercase word shouldn't start a sentence, 'XKCD' is an okay alternative. 'Xkcd' is frowned upon."
Xkcd Password Generator
41–50 of 299 posts
Re: Xkcd Password Generator
#42Earlier quoted context omitted.
> he can trivially test combinations of dictionary words in very short amount of time. Explain the reasoning behind this, please. Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). How many words are in there? How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase) How many for three? How…
> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note…
I actually didn't ignore the 'common' limitation (and didn't downvote you - I'm actually interested how you come up with that).
Follow-up questions:
- What are the first tests, before this 3rd that tests for words? I assume tests for passwords of the first/left variety in the comic? Aren't they cheaper?
- 'Up to three words' is reducing the exponent of possible combinations by one. Length/number of words is relevant
Edit: Another issue. You say 'people forget the human factor', while you, yourself, propose something like '4 times Hack News with substitutions' as better. How is that including the 'human factor'?
Re: Xkcd Password Generator
#43I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…
Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.
Re: Xkcd Password Generator
#44Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…
> H4ck3r N3ws H4ck3r News H4cker News Hacker News
Maybe you have an excellent memory, but I'd forget this in a week. "Now let's see, is it the third 'hacker' that has the 4 AND the 3 in it? Or the 2nd?"
Re: Xkcd Password Generator
#45"For those of us pedantic enough to want a rule, here it is: The preferred form is "xkcd", all lower-case. In formal contexts where a lowercase word shouldn't start a sentence, 'XKCD' is an okay alternative. 'Xkcd' is frowned upon."
[deleted]
Re: Xkcd Password Generator
#46You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.
Re: Xkcd Password Generator
#47Once hackers realise people are using ~4 random words for a password the entropy will decrease hugely.
Re: Xkcd Password Generator
#48What about sites that don't allow spaces? I know hotukdeals.com only allows [a-zA-Z0-9] which sucks.
Leave the spaces out..?
Re: Xkcd Password Generator
#49Sorry, but this isn't novel. I can't find it now, but I read a blog post that described this technique recently (~6 months ago).
Edit: y0ghur7_xxx (http://news.ycombinator.com/item?id=2872827) found it: http://www.baekdal.com/tips/password-security-usability
Re: Xkcd Password Generator
#50Earlier quoted context omitted.
> he can trivially test combinations of dictionary words in very short amount of time. Explain the reasoning behind this, please. Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). How many words are in there? How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase) How many for three? How…
> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note…
100,000 words x 4 words per password ~ 66 bits of entropy
XKCD suggests 2048 words x 4 words per password ~ 44 bits of entropy
It could be good enough depending on a use case.