41–50 of 52 posts
Don't most password managers have a feature that enables you to locally generate a random, high-entropy password? If you're using a manager in the first place you don't really need to remember it, right? Also, I've always wondered if it was better, worse, or of no consequence to leave spaces in a passpharse.
Earlier quoted context omitted.
Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."
"The oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick." -- Bruce. https://www.schneier.com/blog/archives/2014/03/choosing_secu...
Actually this is not such a good idea, this type of passwords is very easy to break with modern dictionary attacks. Just get yourself a password manager and generate really random passwords. If you really have to remember the password then at least try to mix the words with numbers and non-alphanumeric chars.
Reynold (Diceware creator) says: "Five words are breakable with a thousand or so PCs equipped with high-end graphics processors (criminal gangs with botnets of infected PCs can marshal such resources). Six words may be breakable by an organization with a very large budget, such as a large country's security agency. Seven words and longer are unbreakable with any known technology, but may be within the range of large…
Earlier quoted context omitted.
What common user do you know of that has a 100,000 word vocabulary? My point being that a list of the 10,000 most commonly used words would most likely be sufficient to cover most combinations of pass phrases.
It would seem that word length is important too. Between 5 and 8 characters. Wouldn't that drop in half the size of the vocabulary?
XKCD assumes each word has, regardless of length, 11 bits of entropy. It implies that you are picking up each word out of a dictionary of the 2^11 (2048) most common, non-trivial[1] words. And truly, example words are common: correct, horse, battery, staple.
Contrast this with the "classic" example. You pick a single base word from a larger list (16 bits of entropy == 64K-word dictionary) of longer, more complex (troubadour, 10 letter long) words, and then subject it to a number of transformations to pump its entropy another 12 bits.
The key insight of this piece is that attackers have moved over to techniques that make password length a poor estimator of its entropy level. It is the rarity of the base word that makes the lion's share of a password entropy, with length adding marginal improvements, mostly from the increased chances to pack more transformations into it.
This gets lost on the discussion of the comic's main thesis and less subtle insight that it is easier to add entropy by increasing the number of base words than by adding transformations to a single base word.
[1] I am removing trivial words of length < 4 because if you choose from them, you may end up with a password with length between 4 and 12, which may be brute-forced without regard for dictionary attacks now or in the near future. Shortest word in the provided example is "horse" which is weak evidence in favor of this hypothesis.
Actually this is not such a good idea, this type of passwords is very easy to break with modern dictionary attacks. Just get yourself a password manager and generate really random passwords. If you really have to remember the password then at least try to mix the words with numbers and non-alphanumeric chars.
Reynold (Diceware creator) says: "Five words are breakable with a thousand or so PCs equipped with high-end graphics processors (criminal gangs with botnets of infected PCs can marshal such resources). Six words may be breakable by an organization with a very large budget, such as a large country's security agency. Seven words and longer are unbreakable with any known technology, but may be within the range of large…
Earlier quoted context omitted.
Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."
"The oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick." -- Bruce. https://www.schneier.com/blog/archives/2014/03/choosing_secu...
"Explicit" option is only option
Actually this is not such a good idea, this type of passwords is very easy to break with modern dictionary attacks. Just get yourself a password manager and generate really random passwords. If you really have to remember the password then at least try to mix the words with numbers and non-alphanumeric chars.
The attacker knows that I use Diceware. The attacker even knows that I have seven Diceware words in my passphrase.
It's still a secure passphrase.
Don't most password managers have a feature that enables you to locally generate a random, high-entropy password? If you're using a manager in the first place you don't really need to remember it, right? Also, I've always wondered if it was better, worse, or of no consequence to leave spaces in a passpharse.
This is a simple explanation of why passphrasing is better. Please bear with my laymen's mathematics because this isn't my forte: Let's us XKCD as an example. Your passphrase is correcthorsebatterystaple but since you hate typing out things you abbreviate it to chbs. In most English passwords, you are limited to the characters visible to you on your keyboard; 52 letters (caps and lowercase), 10 numbers, 32 symbols. T…
Example 1: "chbs". 94^4 is way too optimistic. Your upper bound is 26^4, though if you get a smart attacker, he will figure out that 'c', 'h', 'b' and 's' are all more likely than 'x' or 'q' (though less likely than 'e' or 't'), and prune the search tree accordingly. Honestly, it does not really matter because with just 4 chars long, he can afford to just brute-force it anyways.
Example 2: "correcthorsebatterystaple". While much, much better than "chbs", 94^25 is completely off-base. That would imply that you are using all printable ASCI characters in your passphrase. The other figure you mention, 250000^4 is closer to the mark, though it implies you are picking your samples from a 25,000 word dictionary.
XKCD does not make that assumption, it explicitly uses a small dictionary (2048 words) to let it clear that you do not depend on picking "epic words" for the scheme to stand. You can use simple, every day (e.g. easy to remember) words and still come ahead of the other approach.