460

submitted 3 days ago by [email protected] to c/[email protected]

22 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] [email protected] 25 points 3 days ago

Pass PHRASES are much better anyway.

Nobody's gonna remember "pyf85ruGmmgæ&Oy_w48euaT0lt" so they'll either write it down, save it to their browser,or use a password manager, either of which makes it less secure.

On the other hand, something simple that doesn't necessarily make sense, say "AlmondsMakeFineGrenades" is difficult for both humans and machines to guess, but easy to remember.

Tl;Dr: an xkcd comic explaining it much better than I just did 😁

[-] [email protected] 5 points 2 days ago

Until you get hit with a dictionary attack.

Luckily this isn't really viable today as most logins just block you after like 5 attempts.

~~only sucks when you have 6 passwords and don't remember which one~~

[-] [email protected] 4 points 2 days ago* (last edited 2 days ago)

Until you get hit with a dictionary attack.

As I explained to the other one, no dictionary attack will happen upon that exact combination of words any faster than the keyboard mashing preceding it.

Using a COMMON word or a COMMON phrase would leave you vulnerable, sure, but no prediction process is going to happen on the exact combination.

Hell, add a word or two to "SaltyIceteaMaker" and it would make an extremely secure pass phrase. For something without that string in the user id, of course 😁

[-] [email protected] 1 points 2 days ago

It's still less combinations than just scramble tho. It may be enough idk, but an algorithm that just combines words would definitely at some point arrive at like "SaltyIceteaMakerBlueAcorn" it's only once you add random letters/numbers/special characters that a dictionary attack stops working.

Although this probably doesn't matter as it would likely still take like a century or ten to complete

[-] [email protected] 0 points 2 days ago

It's still less combinations than just scramble tho

Not in any meaningful way, no. There's what, hundreds of thousands of words in the English language? With no apparent pattern, that's a near-infinite number of possible combinations of 5 or 6 word phrases.

Add that most password crackers would use another kind of attack that presupposes that there's numbers and special characters and you really have redundancy on redundancy.

an algorithm that just combines words would definitely at some point arrive at like "SaltyIceteaMakerBlueAcorn"

Not within your lifespan or even that of humanity.

it's only once you add random letters/numbers/special characters that a dictionary attack stops working.

That's just not true if you don't consider "might theoretically get there in a million years" as "working".

Although this probably doesn't matter as it would likely still take like a century or ten to complete

Exactly. So your entire point is moot. A password or passphrase doesn't need to hold for longer than the existence of the account (or whatever's being protected by it), the user, or the species of the user.