Editing 936: Password Strength
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 8: | Line 8: | ||
==Explanation== | ==Explanation== | ||
− | This comic | + | This comic is saying that the password in the top frames "Tr0ub4dor&3" is easier for password cracking software to guess because it has less entropy than "correcthorsebatterystaple" and also more difficult for a human to remember, leading to insecure practices like writing the password down on a post-it attached to the monitor. |
− | {{w|Entropy (information theory)| | + | In simple cases the {{w|Entropy (information theory)|entropy}} of a password is calculated as ''a^b'' where ''a'' is the number of allowed symbols and ''b'' is its length. A dictionary word (however long) has an entropy of around 65000, i.e. 16 bits. A truly random string of length 11 (not like "Tr0ub4dor&3", but more like "J4I/tyJ&Acy") has 94^11 = 72.1 bits. However the comic shows that "Tr0ub4dor&3" has only 28 bits of entropy. Another way of selecting a password is to have 2048 "symbols" (common words) and select only 4 of those symbols. 2048^4 = 44 bits, much better than 28. |
− | + | It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can confirmed by using [http://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results. | |
− | |||
− | |||
− | |||
− | It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can | ||
In addition to being easier to remember, long strings of lowercase characters are also easier to type on smartphones and {{w|Virtual keyboard|soft keyboards}}. | In addition to being easier to remember, long strings of lowercase characters are also easier to type on smartphones and {{w|Virtual keyboard|soft keyboards}}. | ||
− | xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup> | + | xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup> bits. For comparison, the [http://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [http://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list. |
;Example | ;Example | ||
Line 64: | Line 60: | ||
|- | |- | ||
|correct​horse​battery​staple | |correct​horse​battery​staple | ||
− | | | + | |0 |
− | | | + | |Because of this comic, this password has no entropy |
|} | |} | ||
Line 74: | Line 70: | ||
:(*) The use of random.org explains why <code>jAwwBYne</code> has two consecutive w's, why <code>Re-:aRo</code> has two R's, why <code>_@~"#^.2</code> has no letters, why <code>ewpltiayq</code> has no numbers, why "constant yield" is part of a password, etc. A human would have attempted at passwords that looked random. | :(*) The use of random.org explains why <code>jAwwBYne</code> has two consecutive w's, why <code>Re-:aRo</code> has two R's, why <code>_@~"#^.2</code> has no letters, why <code>ewpltiayq</code> has no numbers, why "constant yield" is part of a password, etc. A human would have attempted at passwords that looked random. | ||
− | |||
− | |||
The title text likely refers to the fact that this comic could cause people who understand information theory and agree with the message of the comic to get into an infuriating argument with people who do not — and disagree with the comic. | The title text likely refers to the fact that this comic could cause people who understand information theory and agree with the message of the comic to get into an infuriating argument with people who do not — and disagree with the comic. | ||
− | If you're confused, don't worry; you're in good company | + | If you're confused, don't worry; you're in good company. Even security "experts" like Steve Gibson and Bruce Schneier misunderstand the comic's point: [https://www.grc.com/sn/sn-313.htm#!s!math%20is%20wrong Steve Gibson Security Now transcript] and [https://subrabbit.wordpress.com/2011/08/26/how-much-entropy-in-that-password/ rebuttal], [https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html#!s!xkcd Schneier original article] and rebuttals: [http://robinmessage.com/2014/03/why-bruce-schneier-is-wrong-about-passwords/ 1] [http://www.reddit.com/r/technology/comments/1yxgqo/bruce_schneier_on_choosing_a_secure_password/cfp2z9k 2] [http://www.reddit.com/r/YouShouldKnow/comments/232uch/ysk_how_to_properly_choose_a_secure_password_the/cgte7lp 3] [http://www.reddit.com/r/YouShouldKnow/comments/232uch/ysk_how_to_properly_choose_a_secure_password_the/cgszp62 4] [http://www.reddit.com/r/YouShouldKnow/comments/232uch/ysk_how_to_properly_choose_a_secure_password_the/cgt6ohq 5] |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | + | Computer security consultant Mark Burnett has posted a [http://xato.net/passwords/analyzing-the-xkcd-comic/ discussion and analysis] of this comic on his blog. | |
==Transcript== | ==Transcript== | ||
Line 113: | Line 100: | ||
:~28 bits of entropy | :~28 bits of entropy | ||
− | :2<sup>28</sup> = 3 days at 1000 guesses | + | :2<sup>28</sup> = 3 days at 1000 guesses sec |
:(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.) | :(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.) | ||
− | :Difficulty to guess: Easy | + | :Difficulty to guess: Easy. |
:[Cueball stands scratching his head trying to remember the password.] | :[Cueball stands scratching his head trying to remember the password.] | ||
:Cueball: Was it trombone? No, Troubador. And one of the O's was a zero? | :Cueball: Was it trombone? No, Troubador. And one of the O's was a zero? | ||
:Cueball: And there was some symbol... | :Cueball: And there was some symbol... | ||
− | :Difficulty to remember: Hard | + | :Difficulty to remember: Hard. |
:[The passphrase "correct horse battery staple" is shown in the center of the panel.] | :[The passphrase "correct horse battery staple" is shown in the center of the panel.] | ||
:Four random common words {Each word has 11 bits of entropy.} | :Four random common words {Each word has 11 bits of entropy.} | ||
− | :~ | + | :~44 bits of entropy |
− | :2<sup>44</sup> = 550 years at 1000 guesses | + | :2<sup>44</sup> = 550 years at 1000 guesses sec |
− | :Difficulty to guess: Hard | + | :Difficulty to guess: Hard. |
:[Cueball is thinking, in his thought bubble a horse is standing to one side talking to an off-screen observer. An arrow points to a staple attached to the side of a battery.] | :[Cueball is thinking, in his thought bubble a horse is standing to one side talking to an off-screen observer. An arrow points to a staple attached to the side of a battery.] | ||
:Horse: That's a battery staple. | :Horse: That's a battery staple. | ||
− | :Observer: | + | :Observer: Correct! |
:Difficulty to remember: You've already memorized it | :Difficulty to remember: You've already memorized it | ||
Line 137: | Line 124: | ||
==External links== | ==External links== | ||
− | + | *Some info was used from the highest voted answer given to the question of "how accurate is this XKCD comic" at StackExchange [http://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase]. | |
− | *Some info was used from the highest voted answer given to the question of "how accurate is this XKCD comic" at StackExchange [ | + | *Similarly, a question of "how right this comic is" was made at AskMetaFilter [http://ask.metafilter.com/193052/Oh-Randall-you-do-confound-me-so] and [[Randall]] responded [http://ask.metafilter.com/193052/Oh-Randall-you-do-confound-me-so#2779020 there]. |
− | *Similarly, a question of "how right this comic is" was made at AskMetaFilter [ | ||
*Also the Wikipedia article on '{{w|Passphrase}}' is useful. | *Also the Wikipedia article on '{{w|Passphrase}}' is useful. | ||
− | *In case you missed it in the explanation, GRC's Steve Gibson has a fantastic page [https://www.grc.com/haystack.htm] about this (and may have prompted this comic, as his podcast [ | + | *In case you missed it in the explanation, GRC's Steve Gibson has a fantastic page [https://www.grc.com/haystack.htm] about this (and may have prompted this comic, as his podcast [http://www.grc.com/sn/sn-303.htm] about this was posted the month before this comic). |
− | |||
− | |||
− | |||
− | |||
− | |||
{{comic discussion}} | {{comic discussion}} | ||
Line 152: | Line 133: | ||
[[Category:Math]] | [[Category:Math]] | ||
[[Category:Computers]] | [[Category:Computers]] | ||
− | |||
− |