Hacker News Reader

Less than 1% of passwords contained a non-alphanumeric character, only 4% actually used more than two character types

I think we're past the paradigm of gobbledy-gook passwords now. As we learned from xkcd [1], it's possible -- in fact, easier -- to construct a secure password that's also readable as needed.

[1] http://xkcd.com/936/

View on HN

That comic is misleading. Depending on the method of attack, the suggested password can be easier to crack. Attackers aren't constricted by the number of characters, but by the number of tokens. Are you sure that one of those passwords comes from a higher number of permutations?

Yes. If you choose your four words from a dictionary of, say, 2000, then there are 1.6e13 combinations -- about 44 bits of entropy.

If you choose 11 characters from a conservative set of 72, then there are 5.2e19 combinations. Isn't that stronger?

The comic is amusing, but it only works if you can apply it uniquely across accounts. Once you start creating unique passwords of that length you can't remember them. Get a password manager and forget about patterns - the XKCD approach doesn't work without serious compromise.

Reply on news.ycombinator.com