Discussion on answer by Jeff Atwood: XKCD #936: Short complex password, or long dictionary passphrase?

@JeffAtwood John the Ripper is a pretty standard password cracking tool and finds Tr0ub4dor&3 after for few ¢ of EC2. Do you have data to support your assertion that attackers don't use such tools in practice?

@Jeff, I assume you've seen this - How reliable is a password strength checker? My answer there shows a basic comparison of entropy breakdown, short complex password vs long simple password. Also see this answer which discusses the entropy of dictionary phrases. The password strength checker you used does not account for dictionary words, or entropy of selecting English language words as opposed to bruteforcing random characters.

The rumkin.com checker is dangerously misleading. It's much less sophisticated than the simple common sense in the XKCD comic, so it shouldn't be used to "confirm" anything. Try it on "passwordpasswordpasswordpassword" which allegedly has 128 bits of entropy and is "overkill" security.

The method that Munroe describes (take a word, substitute characters, than add two random characters at the end) is one of the currently implemented modes in John the Ripper, and one that I personally use. So, the suggested "the godlike predictive password attacks" suggested already exist and are in use.

»It's kind of.. bullshit, honestly, to assume godlike knowledge of the password pattern chosen that reduces entropy by half.« Schneier once linked to a really nice article on how a popular password cracking tool works. The developers noted that a large portion of the non-dictionary passwords (which are of course found first) use only a few common schemes, usually a pronouncable-part suffix or prefix pronouncable part one. I don't think cutting the search space is entirely unjustified in this case. People are not necessarily creative when it comes to choosing a password that ...

John the ripper, one of the most popular password cracker, has all the rules used to create "troubadour" based password. Running it with all rules over dictionaries with words from 5 languages doesn't take even an hour on an average PC. While even 3 word combinations from single language are basically uncrackable.

@Gilles " If there isn't any low-hanging password fruit (and oh, there always is), they'll just move on to the next potential victim service"

@gilles well I wasn't really referring to that one, as basic letter-to-number sev7n style substitution is, admittedly, pretty mechanical if you do it totally consistently and repeatably. But passphrases are a different story. If I told you my password is "I live at 55 Maple Lane in Boston", show me the tool that will crack that in sane time using rules and not brute force. I'd love to see it, if you can. :)

@JeffAtwood But that's the whole point of the comic, which your answer refutes: explaining that leet-speak transformations provide negligible security benefit while being significantly harder to memorize. A password like “I live at 55 Maple Lane in Boston” isn't more secure than “I live at fifty-five Maple Lane in Boston”, or “iliveatfiftyfivemaplelaneinboston” for that matter. They are all far too long for any password cracker (this is an 8-word passphrase, and even with the correlations between words, the entropy is high). Your “challenge” has nothing to do with the flaw in your answer.

@gilles well, I do agree that length is an issue in a realm of hardware cracking, see my blog post codinghorror.com/blog/2012/04/speed-hashing.html -- I used my own video hardware, two high end ATI 7970s.. but people ARE implying that pass phrases can be cracked more easily as a pattern just like l33tsp34k can.

@JeffAtwood actually the xkcd is stating the exact opposite: passphrases are much harder to crack than any form of l33tsp34ked password, by order of magnitude. Contrast that with how much harder it is to remember the exact permutation, without adding sufficient benefit... So it seems from your comments that you are now concluding that the xkcd is correct, contrary to the implication in your answer?