Re: [gentoo-user] Coming up with a password that is very strong.

[Rich Freeman]

On Mon, Feb 4, 2019 at 8:21 AM Neil Bothwick <neil@××××××××××.uk> wrote:
>
> On Mon, 04 Feb 2019 11:17:13 +0000, Mick wrote:
>
> > > https://xkcd.com/936/
> >
> > Not strictly true ... the crackers would probably use rainbow tables
> > attacks first.  Also, it isn't fair to compare an 11 character passwd
> > against a 25 character passwd.  For the *same* number of characters
> > used in any given passwd, a random lower/upper/numerical/symbol passwd
> > will provide an exponentially higher degree of difficulty in cracking
> > it with brute force, than one which uses only lower case dictionary
> > words.  Anyway, these days many attacks are focused on OS or hardware
> > vulnerabilities which have been baked in by design, rather than brute
> > force attacks.
>
> I'm not sure xkcd is meant to be taken that seriously...
>

IMO xkcd has treated the situation more seriously than some of the
replies here...

Obviously words from a dictionary have less entropy per character than
random characters do, but the xkcd cartoon already takes this into
account.

For the same number of bits of ENTROPY a random password provides the
exact same level of security as one based on words.

To obtain that entropy through words requires more characters of
course.  However, the whole point of the cartoon is that our brains
are much better at remembering words than random characters, since we
have a big chunk of grey matter evolved to do exactly that which is
more sophisticated than any computer on the planet so far.

Now, if you have some brain-dead software which only accepts 8
character passwords then you would obviously do better to use random
characters (truly random - not picking the most pleasing-looking
random password out of a list) than to try to cram one or two words in
there.  Likewise, if you're using a password manager and want to
maximize entropy per bit of storage/transmission then random passwords
are better since words provide no utility.

However, if you want to obtain the highest number of bits of entropy
for a password that is memorized, xkcd makes a compelling argument
that you're better off with a longer password composed of words,
because they let you cram more entropy into your brain.  Two bits from
a dictionary might be the same as two bits from 1/3rd of a random
character to a brute force cracking engine, but they aren't the same
to your brain.  Xkcd isn't doing a like-for-like comparison, because
the two categories aren't alike.

-- 
Rich