2

I recently went through the tiresome process of changing all of my passwords to something more secure. I did as it is generally recommended nowadays — I made it 16 characters long, including symbols, numbers, uppercase, lowercase, etc., until the final product looked more or less like a random string of data.

And then I came across the following xkcd comic, which is essentially telling me that I am better off simply using a few words back to back, as this will have 99% of the practical security while also being easier to remember.

So my question is, how correct is this comic?

Improve this question
3
  • I'm not going to post this as an answer since I am not so sure of it, but if I understand it correctly, a password nowadays should not consist of only dictionary words. So maybe you should follow the xkcd example, but use some misspelled words, with maybe some numbers tacked on the end.
    – BenjiWiebe
    Jul 28, 2014 at 12:29
  • 2
    The comic is instructive because it provides a password that is both "secure" and easy to remember. However, there is a separate issue of using the same password for all your services... A terrible idea.
    – Brian Adkins
    Jul 28, 2014 at 12:30
  • 4
    There is no such thing as cross-site duplication, but this has been comprehensively discussed at Security.SE. You may find better information there.
    – Jonathan Garber
    Jul 28, 2014 at 12:39

2 Answers 2

Reset to default
6

Yes and no. There's been plenty of discussion over at Security.SE on the subject. Let's start with a quote from an answer by Jeff Goldberg:

What the XKCD comic does not effectively communicate is that the selection of words must be (uniformly) random. If you ask humans to pick words at random, you get a heavy bias for concrete nouns. Such biases can and will be exploited.

This right here is probably the single most important strike against the XKCD scheme. Humans are terrible at coming up with anything random [citation needed]. "I flipping love my wonderful dogs and cats" is certainly "long" enough, but is in no way unpredictable.

(As an aside, Jeff also points out that the XKCD scheme isn't actually original to Randall Munroe:

The overall idea for "XKCD-like" passwords goes at least as far back as the S/Key one time passwords from the early 1980s.

)

The top-voted answer reminds us about the fact that we need to know what we're defending against:

One of the many reasons there is no consistent advice about passwords is it all comes down to an issue of threat modeling. What exactly are you trying to defend against?

For example: are you trying to protect against an attacker who is specifically targeting you and knows your system for generating passwords? Or are you just one of millions of users in some leaked database? Are you defending against GPU based password cracking or just a weak web server? Are you on a host infected with malware?

I think you should assume the attacker knows your exact method of generating passwords and is just targeting you. The xkcd comic assumes in both examples that all the details of the generation are known.

Take a look at this short list. If you fit this profile, then the XKCD scheme is probably right for you:

1. The password will be used in only one place.

2. You care only about keeping honest people and script kiddies out of your account or away from your data.

3. Well... there really isn't a 3.

To put it bluntly, unless you're willing to use Diceware to generate a memorable password, don't bother with the XKCD scheme for anything serious. Troy Hunt analyzed this some time ago. As he says near the end of that post, the "best" password advice is to use fully random passwords and a password manager:

So in total, I’m tracking one hundred and thirty accounts. Very few people will read this and have less than 30 accounts, even if you can’t think of them all off the top of your head right now (can you really remember every account you’ve ever created?) Be honest, add them all up and see what you get to, even the ones you don’t use that often. And if you don’t have 30 accounts now, just how long will it be until you do? Having recently gone through the password management exercise with my father in his 60s and not coming from a technology background, I know that at worst, any regular online user will almost certainly have more accounts than they can count on their fingers and toes and definitely more than they can apply their memory to.

I don't have 130 accounts, but I certainly have more than fingers and toes in my password manager. Every time I change the password to my work computer, it takes me about three weeks of solid usage before I can memorize it. And that's one of maybe 2-4 passwords I actually hand-enter! Try scaling that to 30-100 accounts and it just Simply Doesn't Work.

Improve this answer
6
  • I'm not really sure about whether this is appropriate as an answer on its own, given that a large part of it is drawn from other peoples' work. If the community thinks it would be better I'll flag it for conversion to CW, but I didn't think about it until right after I hit the "submit" button...
    – Jonathan Garber
    Jul 28, 2014 at 13:04
  • 1
    Jonathan, providing you cite your references, this is fine and a good clear answer, with references!! :)
    – Dave
    Jul 28, 2014 at 13:07
  • @DaveRook or anyone: I could use a good cite for "humans are bad at random". That's a key point in this whole subject, but it's not something I could come up with in two minutes of searching. It's stated in one of the Sec.SE answers, but without a citation.
    – Jonathan Garber
    Jul 28, 2014 at 13:11
  • "If you ask humans to pick words at random, you get a heavy bias for concrete nouns", plus: they pick words they know. When thinking about dictionary attacks, some think that all words from a regular (printed) dictionary are tried, and the more the better. I doubt that. Smart dictionary attacks use dictionaries of only common words, not all 355,000 words that would be found in a 2,112 pages Oxford print, or something similar.
    – Arjan
    Jul 29, 2014 at 21:07
  • That's an excellent point about choosing known words, @Arjan. I suppose I'll start looking for a paper titled "Distribution of Vocabulary Sizes Across a Uniformly Regular Populace", or something like that.
    – Jonathan Garber
    Jul 30, 2014 at 13:54
-2

Want safe passwords - not just a single one? Use a generator and have your passwords randomized as long and complicated as possible - Edward Snowden claims the NSA can try about a billion possibilities per second, so you'd better be prepared :-) Then use a password Manager to keep track of all your passwords.

Improve this answer
1
  • True, but how does this answer the question?
    – Arjan
    Jul 28, 2014 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .