Editing 936: Password Strength
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 18: | Line 18: | ||
It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can be confirmed by using [https://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results. | It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can be confirmed by using [https://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results. | ||
| − | In addition to being easier to remember, long strings of lowercase characters are also easier to type on smartphones and {{w|Virtual keyboard|soft keyboards}}. | + | In addition to being easier to remember, and long strings of lowercase characters are also easier to type on smartphones and {{w|Virtual keyboard|soft keyboards}}. |
xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup>, i.e. 44 bits. For comparison, the [https://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [https://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list. | xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup>, i.e. 44 bits. For comparison, the [https://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [https://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list. | ||
