explain xkcd - User contributions [en]

936: Password Strength

2012-09-23T21:40:41Z

94.69.229.140:

{{comic
| number = 936
| date = August 10, 2011
| title = Password Strength
| image = password_strength.png
| imagesize =
| titletext = To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.
}}

==Explanation==
This comic is saying that the password in the top frames "Tr0ub4dor&3" is easier for password cracking software to guess than "correcthorsebatterystaple". And this is absolutely true that people make passwords hard to remember because that means that they are "safer".

It is certainly true that length, all other things being equal, tends to make for very strong passwords and this can confirmed by using [http://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker][1]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results.

Now, what is not clearly addressed:
* Will these passwords have to be ''entered manually''? And if so, how difficult is it, mechanically, to enter a each character of the password? On a keyboard it's easy, but on a smartphone or console... not so much.
* How easy are these passwords to ''remember''?
* How sophisticated are the password attacks? In other words, will they actually attempt common schemes like "dictionary words separated by spaces", or "a complete sentence with punctuation", or "leet-speak numb3r substitution" as implied by xkcd?

Steve Gibson from the Security Now podcast did a lot of work in this arena and found that this password "D0g....................." is harder to break than this password "PrXyc.N(n4k77#L!eVdAfp9". Steve Gibson makes this very clear in his password haystack [https://www.grc.com/haystack.htm reference guide and tester]:

"Once an exhaustive password search begins, '''the most important factor''' is password length!"

The important thing to take away from this comic is that longer passwords are better because each additional character adds much more time to the breaking of the password. That's what xkcd is trying to get through here. Complexity does not matter unless you have length in passwords. Complexity is more difficult for humans to remember. Length is not.

==Transcript==


The comic illustrates the relative strength of passwords assuming basic knowledge of the system used to generate them.
A set of boxes is used to indicate how many bits of entropy a section of the password provides.
The comic is laid out with 6 panels arranged in a 3x2 grid.
On each row, the first panel explains the breakdown of a password, the second panel shows how long it would take for a computer to guess, and the third panel provides an example scene showing someone trying to remember the password.

:[The password "Tr0ub4dor&3" is shown in the centre of the panel. A line from each annotation indicates the word section the comment applies to.]

:Uncommon (non-gibberish) base word
:[Highlighting the base word - 16 bits of entropy.]
:Caps?
:[Highlighting the first letter - 1 bit of entropy.]
:Common Substitutions
:[Highlighting the letters 'a' (substituted by '4') and both 'o's (the first of which is substituted by '0') - 3 bits of entropy.]
:Punctuation
:[Highlighting the symbol appended to the word - 4 bits of entropy.]
:Numeral
:[Highlighting the number appended to the word - 3 bits of entropy.]
:Order unknown
:[Highlighting the appended characters - 1 bit of entropy.]
:(You can add a few more bits to account for the fact that this is only one of a few common formats.)

:~28 bits of entropy
:2^28 = 3 days at 1000 guesses sec
:(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)
:Difficulty to guess: Easy.

:[A person stands scratching their head trying to remember the password.]
:Person: Was it trombone? No, Troubador. And one of the Os was a zero?
:Person: And there was some symbol...
:Difficulty to remember: Hard.

:[The passphrase "correct horse battery staple" is shown in the centre of the panel.]
:Four random common words {Each word has 11 bits of entropy.}

:~44 bits of entropy
:2^44 = 550 years at 1000 guesses sec
:Difficulty to guess: Hard.

:[A person is thinking, in their thought bubble a horse is standing to one side talking to an off-screen observer.
:An arrow points to a staple attached to the side of a battery.]
:Horse: That's a battery staple.
:Observer: Correct!
:Difficulty to remember: You've already memorized it

The caption below the comic reads: Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

==External Links==
* Some info were used from the highest voted answer given to the question of "how accurate is this XKCD comic" at StackExchange [http://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase]
* Similarly a question of "how right this comic" is was made at AskMetaFilter [http://ask.metafilter.com/193052/Oh-Randall-you-do-confound-me-so]
* Also the Wikipedia article on 'Passphrase' is useful [http://en.wikipedia.org/wiki/Passphrase]

{{comic discussion}}

936

2012-09-23T21:21:50Z

94.69.229.140: Redirected page to 936: Password Strength

#REDIRECT [[936: Password Strength]]

936: Password Strength

2012-09-23T21:19:21Z

94.69.229.140: Someone review transcript

{{comic
| number = 936
| date =
| title = Password Strength
| image = password_strength.png
| imagesize =
| titletext = To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.
}}

==Explanation==
This comic is saying that the password in the top frames "Tr0ub4dor&3" is easier for password cracking software to guess than "correcthorsebatterystaple". And this is absolutely true that people make passwords hard to remember because that means that they are "safer".

The important thing to take away from this comic is that longer passwords are better because each additional character adds much more time to the breaking of the password.

Steve Gibson from the Security Now podcast did a lot of work in this arena and found that this password "D0g....................." is harder to break than this password "PrXyc.N(n4k77#L!eVdAfp9". Steve Gibson makes this very clear in his password haystack [https://www.grc.com/haystack.htm reference guide and tester]:

"Once an exhaustive password search begins, '''the most important factor''' is password length!"

That's what xkcd is trying to get through here. Complexity does not matter unless you have length in passwords. Complexity is more difficult for humans to remember. Length is not.

==Transcript==


:((The comic illustrates the relative strength of passwords assuming basic knowledge of the system used to generate them. A set of boxes is used to indicate how many bits of entropy a section of the password provides. The comic is laid out with 6 panels arranged in a 3x2 grid. On each row, the first panel explains the breakdown of a password, the second panel shows how long it would take for a computer to guess, and the third panel provides an example scene showing someone trying to remember the password.))

:[The password "Tr0ub4dor&3" is shown in the centre of the panel.
:A line from each annotation indicates the word section the comment applies to.]
:Uncommon (non-gibberish) base word
:[Highlighting the base word - 16 bits of entropy.]
:Caps?
:[Highlighting the first letter - 1 bit of entropy.]
:Common Substitutions
:[Highlighting the letters 'a' (substituted by '4') and both 'o's (the first of which is substituted by '0') - 3 bits of entropy.]
:Punctuation
:[Highlighting the symbol appended to the word - 4 bits of entropy.]
:Numeral
:[Highlighting the number appended to the word - 3 bits of entropy.]
:Order unknown
:[Highlighting the appended characters - 1 bit of entropy.]
:(You can add a few more bits to account for the fact that this is only one of a few common formats.)

:~28 bits of entropy
:2^28 = 3 days at 1000 guesses sec
:(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)
:Difficulty to guess: Easy.

:[A person stands scratching their head trying to remember the password.]
:Person: Was it trombone? No, Troubador. And one of the Os was a zero?
:Person: And there was some symbol...
:Difficulty to remember: Hard.

:[The passphrase "correct horse battery staple" is shown in the centre of the panel.]
:Four random common words {Each word has 11 bits of entropy.}

:~44 bits of entropy
:2^44 = 550 years at 1000 guesses sec
:Difficulty to guess: Hard.

:[A person is thinking, in their thought bubble a horse is standing to one side talking to an off-screen observer.
:An arrow points to a staple attached to the side of a battery.]
:Horse: That's a battery staple.
:Observer: Correct!
:Difficulty to remember: You've already memorized it

:((The caption below the comic reads: Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.))

{{comic discussion}}