This article is math true, however, hackers no longer use brute force attacks and the most popular method is to attack a weak website like for example a not very popular blog, then if they succesfully broke it they have a password and a email account from you and if they are very lucky you have the same password for the email account, so, they got you.
Therefore, nowadays it is safer to have different passwords for every site.
Personally, I love to use lastpasss for my personal use and keepass for the office to store and manage passwords. Obviously, the weakest link of the chain is my password for the password manager application.
Any of you use a different password manager?
Xkcd Password Generator
121–130 of 299 posts
Re: Xkcd Password Generator
#122When picking a password, you don't just care about the entropy. You also care how far down the password guessing order it is.
People who want to guess a password don't just brute force at random. They use a guessing order that goes through more common classes of password first. So if correct horse battery staple becomes a popular password scheme, these will end up attacked before other password schemes. (See http://www.schneier.com/essay-148.html)
Unless you're going to use a password safe full of nasty passwords, you should pick your passwords using an unpopular method.
Re: Xkcd Password Generator
#123The link posted on the article merits a submission by itself:
"The science of password selection" (a breakdown of common passwords by selection practices, as taken from public leaks)
http://www.troyhunt.com/2011/07/science-of-password-selectio...
In short, passwords are chosen from:
People names: this includes a list of about 26,000 common first and last names.
Place names: this is everything from towns to states to countries and includes about 32,000 entries.
English dictionary
The most common passwords by group:
Name:
1. maggie
2. michael
3. jennifer
1. dallas
2. canada
3. boston
1. password (oh dear)
2. monkey
3. dragon
1. 123456
2. 12345678
3. 123456789Re: Xkcd Password Generator
#124What a great article! I'm changing all my passwords to
"correct horse battery staple" today!
Re: Xkcd Password Generator
#125How about (NOT SECURE YET, IT NEEDS MORE ENTROPY): from nltk.corpus import wordnet as wn all_animals = set() def add_to_set(animal): all_animals.add(animal.name.split('.')[0].replace('_',' ')) for child in animal.hyponyms(): add_to_set(child) add_to_set(wn.synset('animal.n.01')) all_animals = list(all_animals) actions = ['ate','chased','killed','fought','kissed', 'talked to','hated','loved','ambushed','fled'] # can a…
Completely random strings of words can be hard for me to remember, but something like, "the {adjective1} {animal1} {verb} the {ajective2} {verb2}" would be much easier for me to remember because the words relate to each other ways I already understand. I expect we can get some fairly high entropy from just simple schemes like this. However, the length of the password can be a real pain if you have to type it often, e…
You could get about 8 bits per animal, and 5 bits per hand-written verb / adjective / place (32 choices per category). So that's about 7-10 words you need in the frame.
You could get decent entropy with: the {adj} {adj} {animal} {verbed} the {adj} {adj} {animal} from in {place}. That's 5+5+8+5+5+8+5 = 41 bits.
I'm just wondering if it's worth it.
Re: Xkcd Password Generator
#126Re: Xkcd Password Generator
#127If you're bi-lingual in a non-european language, transliterating obscure phrases from the other language could work well. For example, the poetic title திரிகூடராசப்பகவிராயர் would transliterate to thirikUdarAsappaKavirAyar. Add some subs & punctuations and I'm done - very rememberable (at least for me) :).
Re: Xkcd Password Generator
#128Earlier quoted context omitted.
Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15. I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.
Right- I was just correcting the dude's math :-)
hey it was an honest typo
Re: Xkcd Password Generator
#129Earlier quoted context omitted.
171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass
No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.
real complex passwords are more like '"^vmds!w*é$sé550µW"'-à the point of the post was to show the maximum theorical possibilities for both.
As many pointed out not all 255 are usually printable and not all 171K words are used
then that's for english only and not counting old english and not taking care of possible punctuation
Re: Xkcd Password Generator
#130A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…
I make less typing mistakes with shorter, complicated passwords.
Long passwords are typing-error prone. With mobile devices, it gets worse, as typing is really painful.