How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me.
Am I missing something or is th...
A practical note: I have used Diceware to help me select random words before. I found I could remember 5 words really easily. I did roll a couple of times to find a sequence that felt nice to say (in my head) though, without necessarily making sense.
Considering that Troubador is not a word (unlike Troubadour), it is very hard to tell whether any brute-force algorithm will ever be able to break Tr0ub4dor&3 under 550 years. But in general, yes, a 4-words passphase has more entropy. By the way, why does the non-gibberish word weigh 28 bits in the first case, while each word weigh 11 in the second?
I think commentors here have brought up all of these points already but, for the record, here's some elaboration by the comic's author, Randall Munroe: ask.metafilter.com/193052/…
I think commentors here have brought up all of these points already but, for the record, here's some elaboration by the comic's author, Randall Munroe: ask.metafilter.com/193052/…
@poke Apparently I cannot count today. We could always remove a character to the word, though; it would be tougher to break, except if the password is known. However, we should really consider security strength in the worst case: if the attacker knows the process by which the password is generated.
Does bit entropy applies if I one uses only common words coming from a dictionnary ? Brute force is long, but you can take shortcut by, for example, for all password you'll try, put combinations of common word first. Would those method be faster ?
@Lotus Notes: actually, no it doesn't make me wonder. They do exactly what the were told to do a while back and no more. In the "old" days the recommendation was a combination of upper and lower case along with numbers and punctuation. So banks did this. Later due to sql injection, punctuation as even being allowed in a number of banking passwords. The only way they are going to grow out of it is if a regulatory body says they must change.
Some more recent old news: "Claimed DigiNotar hacker: domain administrator password of the DigiNotar network was Pr0d@dm1n." Source: theregister.co.uk/2011/09/06/comodohacker_claims_diginotar_hack (FWIW, most password strength checkers rate this password as "very strong".)
@ugurcode: Note that it says insecure web service. Yes, well designed systems do limit the number of password attempts, but not all do. Also, if the attacker has a decent sized botnet IP based blocking isn't going to help you anyway. You'd additionally have to have username-per-time based denial, at the very least.
@Eric: I believe the comic and answers below answer that pretty well. Using a dictionary helps, sure. But even if you have a dictionary of 2^12 words (which is a pretty small dictionary), four words still gives you 50 bits of entropy. (which is exactly what the comic demonstrates with the little boxes) At 1000 guesses / second that's hundreds of years. (As the comic says, cracking a stolen hash is faster; but most any password can be cracked fast with that method)
Having read this with interest, one thought occurred to me about a different sort of attack not mentioned so far: key loggers. You could very easily guess that "Tr0ub4dor&3" cropping up in a log is a password, whereas normal words separated by spaces or regular punctuation would not stand out so far. Just a thought.
A long but easy to remember password (or pass-phrase) is susceptible to dictionary attacks, however a short but complex password may be vulnerable to brute forcing. So in my opinion, think of a easy to remember complex password. For eq, think of a long sentence like - "I will be going to mall at 8 PM". So you can create a password by picking first character of every word and create a password like this (including capitalization and numbers) - Iwbgtma8P and then add your favourite command/code at end. Final password - Iwbgtma8P#include<stdio.h> - easy to remember and hard to crack...
@LotusNotes asked about bank password policies. Uğur Gümüşhan noted that IPs could be granted a max number of tries. Billy ONeal noted that a botnet can work around that issue. Most banks will lock any account with a certain number of failed passwords irrespective of the origin of the attempt(s). This is very very very secure, but comes at a high cost: an attacker can lock you out of your account in a matter of seconds.
@AlexBowe you reduce the entropy by discarding hard-to-say sentences from diceware. 5 words is only ~64.6 bits of entropy if you don't discriminate on the answers it gives you.
Just to state the obvious once, as it seems nobody did yet: most password systems doesn't let you choose a password like correcthorsebatterystaple, for multiple reasons: because it doesn't contain any capital letter, number or special character, and even because it's too long!
There isn't much to get wrong while choosing safe passwords. Longer is generally better but it's even better when you use capitalization, numbers and special characters. I'm building my passwords like it. Just think of some weird'o sentence that contaisn Numbers and special characters. Example: "BountyOf$400Archieved" or "400°SpinHeadshotFrenchUnit". I think they're very easy to remember, long passwords. As a german I'm also trying to use german Umlaute like ÄÖÜß because they're on my keyboard
Discussion on question by Billy ONeal…
Discussion on question by Billy ONeal…