Talk:936: Password Strength - Revision history

Lamda05: add talk

2025-09-11T05:48:27Z

add talk

172.69.222.69 at 19:29, 25 December 2024

2024-12-25T19:29:21Z

42.book.addict at 21:58, 5 November 2024

2024-11-05T21:58:06Z

42.book.addict at 21:56, 5 November 2024

2024-11-05T21:56:56Z

172.69.43.166 at 21:11, 11 June 2024

2024-06-11T21:11:01Z

172.68.118.25: idea.

2024-06-11T16:00:04Z

idea.

172.71.215.11 at 23:37, 17 November 2023

2023-11-17T23:37:50Z

172.71.215.12 at 23:36, 17 November 2023

2023-11-17T23:36:40Z

172.71.218.137 at 23:32, 17 November 2023

2023-11-17T23:32:02Z

172.70.86.44: The commemtator concerned looks to have misunderstood the usual signature positioning (probably bevause the one two items a ove looks like it 'headers' the comment only one item above?)

2022-06-27T15:49:42Z

The commemtator concerned looks to have misunderstood the usual signature positioning (probably bevause the one two items a ove looks like it 'headers' the comment only one item above?)

← Older revision		Revision as of 05:48, 11 September 2025
Line 272:		Line 272:

	Basically, use '''truely random''', 100-symbols worth passwords with alpha-numeric-special-characters if you '''truely''' don't want to get hacked. And i apologize for everyone who don't have eidetic memory. --[[Special:Contributions/172.69.222.69\|172.69.222.69]] 19:29, 25 December 2024 (UTC)		Basically, use '''truely random''', 100-symbols worth passwords with alpha-numeric-special-characters if you '''truely''' don't want to get hacked. And i apologize for everyone who don't have eidetic memory. --[[Special:Contributions/172.69.222.69\|172.69.222.69]] 19:29, 25 December 2024 (UTC)
		+
		+	According to Google Ngram, "relevant" is the 2049th most frequent word in English. Consider using it in your password! --[[User:Lamda05\|Lamda05]] ([[User talk:Lamda05\|talk]]) 05:48, 11 September 2025 (UTC)

← Older revision		Revision as of 19:29, 25 December 2024
Line 270:		Line 270:

	guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2," {{unsigned ip\|172.68.118.25\|16:00, 11 June 2024}}		guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2," {{unsigned ip\|172.68.118.25\|16:00, 11 June 2024}}
		+
		+	Basically, use '''truely random''', 100-symbols worth passwords with alpha-numeric-special-characters if you '''truely''' don't want to get hacked. And i apologize for everyone who don't have eidetic memory. --[[Special:Contributions/172.69.222.69\|172.69.222.69]] 19:29, 25 December 2024 (UTC)

@@ Line 66: / Line 66: @@
 The D0g..................... (24 characters long) is NOT stronger than PrXyc.N(n4k77#L!eVdAfp9 (23 characters long). The reason why, is that the later password is random. There is no pattern. The former, "padding" technique can  be very easily cracked. You just need to assume that each character be repeated 1~30 times. Then the first password would become : 1(D)1(0)1(g)21(.), which, is then of complexity 30^4 + 96^4, versus 96^23 for the random password. And that is assuming that any character can be repeated 1~30 times, so DDDDDDDDD0000000ggggggg...... also would be cracked extremely quickly. If you limit yourself to only last character padding, your password now becomes 30*96^4 possibilities. {{unsigned ip|108.162.222.235}}
-And that's why it is stupid to explain this kind of joke : it depends on many (MANY) parameters such as brute-force method and encryption/hash algorithm. Giving this kind of (wrong) explanations about "pass cracking" (as if it was always the same way to process ...) is ridiculous. And they talk about entropy .......... Holy shit, go back to school and stop screwing cryptography up. zM_
+And that's why it is stupid to explain this kind of joke : it depends on many (MANY) parameters such as brute-force method and encryption/hash algorithm. Giving this kind of (wrong) explanations about "pass cracking" (as if it was always the same way to process ...) is ridiculous. And they talk about entropy .......... Holy shit, go back to school and stop screwing cryptography up. zM_ {{unsigned ip|163.245.49.126|21:41, 18 June 2015 (UTC)}}
 I just use a password with a ␡ character or two, and ␇ for banks.  [[Special:Contributions/108.162.242.21|108.162.242.21]] 08:33, 18 August 2015 (UTC)

@@ Line 1: / Line 1: @@
 ''Fix the software first.''  If you double the time it takes to enter each repeated password attempt you make brute force attacks pointless.   Imagine you allowed a hurried user who screws up their own password entry w/ frozen fingers. If their system starts out with a 1 second delay, then doubles to two, then to four, etc. the time it takes to wait is 2^n.  Six screw ups cost you a minute, twenty errors and you are waiting 291 hours before your next log-in attempt....  kmc 2015-05-10 {{unsigned ip|108.162.229.124}}
 : That's not how brute force attacks work.  They steal the hashes of the passwords and then brute force them locally. [[Special:Contributions/198.41.235.107|198.41.235.107]] 23:43, 10 January 2016 (UTC)
 :: Both are brute force. It is specified in the comic that we assume an attack against a weak remote web service though. --[[Special:Contributions/162.158.150.231|162.158.150.231]] 13:10, 16 September 2016 (UTC)
 You still have to vary the words with a bit of capitalization, punctuation and numbers a bit, or hackers can just run a dictionary attack against your string of four words. '''[[User:Davidy22|<u>{{Color|purple|David}}<font color=green size=3px>y</font></u><font color=indigo size=4px>²²</font>]]'''[[User talk:Davidy22|<tt>[talk]</tt>]] 09:12, 9 March 2013 (UTC)
@@ Line 12: / Line 10: @@
 That means he's assuming a dictionary of 2048 words, from which each word is picked randomly.
 The assumption is that the cracker knows your password scheme.
-[[Special:Contributions/86.81.151.19|86.81.151.19]] 20:17, 28 April 2013 (UTC)
+[[Special:Contributions/86.81.151.19|86.81.151.19]] 20:17, 28 April 2013 (UTC) Willem
 :I just wrote a program to bruteforce this password creation method. https://github.com/KrasnayaSecurity/xkcd936/blob/master/listGen936.py  Once I get it I'll try coming up with more bruteforcing algorithms such as substituting symbols, numbers, camel case, and the like.  Point is, don't rely on this or any one method.  I wouldn't be surprised if the crackers are already working on something like this.  [[User:Lieutenant S.|Lieutenant S.]] ([[User talk:Lieutenant S.|talk]]) 07:03, 8 September 2014 (UTC)
 :It took 1.25 hours to bruteforce "correcthorsebatterystaple" using the 2,000 most common words with one CPU. [[User:Lieutenant S.|Lieutenant S.]] ([[User talk:Lieutenant S.|talk]]) 07:09, 9 September 2014 (UTC)
@@ Line 66: / Line 62: @@
 Tip:
-Not Barings. They have an history of intransigence and stupidity. (Still revered in banks though as able to cure colon cancer with poor investment strategies.)
+Not Barings. They have an history of intransigence and stupidity. (Still revered in banks though as able to cure colon cancer with poor investment strategies.) [[User:Weatherlawyer| I used Google News BEFORE it was clickbait]] ([[User talk:Weatherlawyer|talk]]) 13:46, 23 January 2015 (UTC)
 The D0g..................... (24 characters long) is NOT stronger than PrXyc.N(n4k77#L!eVdAfp9 (23 characters long). The reason why, is that the later password is random. There is no pattern. The former, "padding" technique can  be very easily cracked. You just need to assume that each character be repeated 1~30 times. Then the first password would become : 1(D)1(0)1(g)21(.), which, is then of complexity 30^4 + 96^4, versus 96^23 for the random password. And that is assuming that any character can be repeated 1~30 times, so DDDDDDDDD0000000ggggggg...... also would be cracked extremely quickly. If you limit yourself to only last character padding, your password now becomes 30*96^4 possibilities. {{unsigned ip|108.162.222.235}}
 And that's why it is stupid to explain this kind of joke : it depends on many (MANY) parameters such as brute-force method and encryption/hash algorithm. Giving this kind of (wrong) explanations about "pass cracking" (as if it was always the same way to process ...) is ridiculous. And they talk about entropy .......... Holy shit, go back to school and stop screwing cryptography up. zM_
 I just use a password with a ␡ character or two, and ␇ for banks.  [[Special:Contributions/108.162.242.21|108.162.242.21]] 08:33, 18 August 2015 (UTC)
 I'am astonished that even someone like Schneier don't get 936 right immediately after reading it. So, I think I know what was going on in Munroes mind conceptually. Maybe there are some grans of salt, but I don't have a problem with these. But I do have one (or two) quantitative problem(s) with 936:
@@ Line 257: / Line 248: @@
 As for "author's 28 bits mistake". I believe that Randall does mean the common lexicon with mangling substitutions. That means that counterexample "J4I/tyJ&Acy" does have 72bits, but nonetheless is irrelevant to character/personage strategy of choosing a memorable yet strong password. [[Special:Contributions/172.68.215.113|172.68.215.113]] 13:17, 23 February 2020 (UTC)
 Ah... this reminds me of one of my old password.
@@ Line 270: / Line 260: @@
 > It had hints of itself in itself.
 --[[Special:Contributions/172.68.154.70|172.68.154.70]] 08:22, 8 April 2020 (UTC)
@@ Line 279: / Line 268: @@
 The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard. [[Special:Contributions/172.71.215.11|172.71.215.11]] 23:37, 17 November 2023 (UTC)
 guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2," {{unsigned ip|172.68.118.25|16:00, 11 June 2024}}

← Older revision		Revision as of 21:11, 11 June 2024
Line 281:		Line 281:


−	guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2,"	+	guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2," {{unsigned ip\|172.68.118.25\|16:00, 11 June 2024}}

← Older revision		Revision as of 16:00, 11 June 2024
Line 279:		Line 279:

	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard. [[Special:Contributions/172.71.215.11\|172.71.215.11]] 23:37, 17 November 2023 (UTC)		The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard. [[Special:Contributions/172.71.215.11\|172.71.215.11]] 23:37, 17 November 2023 (UTC)
		+
		+
		+	guy guys i have an idea: "correcT horsE batterY staplE exkcdponent 2,"

← Older revision		Revision as of 23:37, 17 November 2023
Line 278:		Line 278:
	This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)		This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)

−	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard.	+	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard. [[Special:Contributions/172.71.215.11\|172.71.215.11]] 23:37, 17 November 2023 (UTC)

← Older revision		Revision as of 23:36, 17 November 2023
Line 278:		Line 278:
	This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)		This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)

−	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. ~~Anyway~~, ~~password~~-~~cracking isn't too much~~ to ~~worry about; hackers will usually social-engineer~~ their ~~access to data. [[Special:Contributions/172.71.218.137\|172.71.218~~.~~137]] 23:32, 17 November 2023 (UTC)~~	+	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Also, introduce deliberate mis-spellings: that makes it harder to crack, even if the attacker guesses the word. That was probably the intent behind the "numbers & symbols" rule in the first place, back before Unicode existed and computer users were limited to what was on their keyboard.

← Older revision		Revision as of 23:32, 17 November 2023
Line 277:		Line 277:

	This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)		This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)
		+
		+	The best password/passphrase should be something that has meaning to you and only you; for example, I used to use the password NurseSlutButt, which came from working at an office where the manager had one of his walls covered with the employees' personal memorabilia and one of those was a 1959 newspaper clipping about the new matron of a local orphanage, so that phrase developed from idly staring at the clipping and thinking about her and how she looked in the accompanying photo. I never told anyone about that password until now. Anyway, password-cracking isn't too much to worry about; hackers will usually social-engineer their access to data. [[Special:Contributions/172.71.218.137\|172.71.218.137]] 23:32, 17 November 2023 (UTC)

← Older revision		Revision as of 15:49, 27 June 2022
Line 276:		Line 276:
	Ah yes, now Microsoft has disabled plaintext words in passwords. I can see where they were trying to go with this but it completely backfired for everyone who doesn't use the password "password". -[[User:Alpha2\|Alpha2]] ([[User talk:Alpha2\|talk]]) 15:20, 13 October 2021 (UTC)		Ah yes, now Microsoft has disabled plaintext words in passwords. I can see where they were trying to go with this but it completely backfired for everyone who doesn't use the password "password". -[[User:Alpha2\|Alpha2]] ([[User talk:Alpha2\|talk]]) 15:20, 13 October 2021 (UTC)

−	--[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)	+	This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23 --[[Special:Contributions/172.70.175.146\|172.70.175.146]] 14:51, 27 June 2022 (UTC)
−
−	~~This scheme (four words) was used for the default wifi and admin passwords on a T Mobile wireless home internet gateway received on 2022-Jun-23~~