Hacker News Reader

That comic is misleading. Depending on the method of attack, the suggested password can be easier to crack. Attackers aren't constricted by the number of characters, but by the number of tokens. Are you sure that one of those passwords comes from a higher number of permutations?

View on HN

Yes. If you choose your four words from a dictionary of, say, 2000, then there are 1.6e13 combinations -- about 44 bits of entropy.

The comic is amusing, but it only works if you can apply it uniquely across accounts. Once you start creating unique passwords of that length you can't remember them. Get a password manager and forget about patterns - the XKCD approach doesn't work without serious compromise.

If you choose 11 characters from a conservative set of 72, then there are 5.2e19 combinations. Isn't that stronger?

Reply on news.ycombinator.com