Editing 936: Password Strength
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 21: | Line 21: | ||
xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup>, i.e. 44 bits. For comparison, the [https://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [https://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list. | xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup>, i.e. 44 bits. For comparison, the [https://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [https://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list. | ||
| + | |||
| + | {{w|Steve Gibson (computer programmer)|Steve Gibson}} from the {{w|Security Now}} podcast did a lot of work in this arena and found that the password <code>D0g.....................</code> (24 characters long) is stronger than <code>PrXyc.N(n4k77#L!eVdAfp9</code> (23 characters long) because both have at least one uppercase letter, lowercase letter, number, and "special" character, so length trumps perceived complexity. Steve Gibson makes this very clear in his password haystack [https://www.grc.com/haystack.htm reference guide and tester]: | ||
| + | :"Once an exhaustive password search begins, '''the most important factor''' is password length!" | ||
| + | |||
| + | The important thing to take away from this comic is that longer passwords are better because each additional character adds much more time to the breaking of the password. That's what [[Randall]] is trying to get through here. Complexity does not matter unless you have length in passwords. Complexity is more difficult for humans to remember, but length is not. | ||
;Example | ;Example | ||
