Xkcd Password Generator

Post by ErrantX » Thu, Aug 11, 2011, 2:22 PM UTC

darklajid wrote: post #42

ErrantX wrote: post #25

Earlier quoted context omitted.

> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note…

I actually didn't ignore the 'common' limitation (and didn't downvote you - I'm actually interested how you come up with that). Follow-up questions: - What are the first tests, before this 3rd that tests for words? I assume tests for passwords of the first/left variety in the comic? Aren't they cheaper? - 'Up to three words' is reducing the exponent of possible combinations by one. Length/number of words is relevant…

Post by flatline » Thu, Aug 11, 2011, 2:24 PM UTC

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Post by iaskwhy » Thu, Aug 11, 2011, 2:25 PM UTC

corin_ wrote: post #14

iaskwhy wrote: post #12

I always thought using two password fields with simple words would be much harder to break than one field only (which can be used to really strange passwords but also for simples ones as we all know). Someone care to calculate how much it would take to break it?

Well it depends how it's stored, but assuming a fairly standard setup it wouldn't particularly help. The main issue with website security isn't people brute forcing the website login box, it's people cracking the hashes after stealing them. So if you had two easy to crack hashes stored in the database, you crack them both and off you go.

Post by Simucal » Thu, Aug 11, 2011, 2:27 PM UTC

colanderman wrote: post #43

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

Post by bnegreve » Thu, Aug 11, 2011, 2:29 PM UTC

ErrantX wrote: post #25

darklajid wrote: post #17

Earlier quoted context omitted.

> he can trivially test combinations of dictionary words in very short amount of time. Explain the reasoning behind this, please. Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). How many words are in there? How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase) How many for three? How…

> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note…