Hacker News Reader

Comment by nullc | Hacker News Reader

The XKCD comic assumes the attacker has 1000 guesses per second, but a single GPU box on a stolen hash can easily hit a couple billion guesses per second. So the security model of the comic is extremely optimistic compared to some completely reasonable and common threat models.

Fortunately the readme on the target page appears to show the tool defaulting to passwords of considerably higher security than demonstrated in the comic which ought to provide reasonable security under a broader set of attack models.

View on HN

You've got to remember that this comic came out at a time when password managers were not extremely common, and the general consensus for a "good" password looked something like this: X8woi$SD

The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters. But if you introduce some random numbers or special characters into the words, it's still easy to remember and type, but becomes much more difficult to crack.

> introduce some random numbers or special characters into the words, it's still easy to remember and type

If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy!

If you do it automatically and in a way that has high entropy the result is a lot less memorable.

Probably just adding an additional word adds more entropy at less memorability cost.

>If you do it automatically and in a way that has high entropy the result is a lot less memorable.

I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.

Attackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think.

It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.

> it's still easy to remember and type

I think the "ah-ha" moment for me was realising that I needed neither to be able to remember nor to type my passwords.

Once that happens, passwords like 5Ze2vz7AdDjWbXXq start to look great rather than awful :)

That is a much better password, but there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already.

> there are occasions where you need to type a password. For instance, bootstrapping a new device that doesn't have your password manager installed already

Right, but the whole point is that the (hopefully) one-time pain of doing this is worth it in the long run.

> The big thing (in my opinion) that the comic gets wrong, and that all implementations of the password spec follow, is that if an attacker has reason to assume you might be using this style of password, then each word sort of becomes a single "character," albeit from a much larger list of possible characters.

Why you think that is "wrong"? It's the whole idea behind passphrases to consider each word as a symbol, and it's also what the xkcd entropy calculation is based on.

From the comic:

> (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)

And he's right (if you don't trust the website to hash the password securely, then you should assume your password is stored in plain text anyway)

I do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)... and the stakes that users face has also involved in the time since the comic was written.

E.g. I've seen people get burned using the comics advice for "brainwallets", which is equivalent to having a published unsalted hash.

It's okay to have a confined security model, so long as you understand that's what you're doing. But users usually lack any real ability to gauge how likely password hashes are to leak just due to lack of information on how the sites operate. I think a better justification of the comic's original security level is that it's sufficient for protecting things where a compromise is only a nuisance, as is usually the case for 'random website'. But that isn't true for all password choices people make.

The only places I use 6 phrase diceware passwords ((6^5)^6 combinations) is FDE. I control the KDF and configure it to take at least a second on the host I am using FDE on. Even if you take these modern KDFs and find a way to do them 1000000 times faster, thats still an average of 3.5 billion years to crack (assuming you know i used diceware, know my word list, and know how I have formatted the password).

I think I'll be fine.

Also, I use real dice.

Let me know if I calculated that wrong. The calculation was: (6^5)^6 / 1000000 / 2 / 60 / 60 / 24 / 365

The constants:

6 - sides on a D6

5 - dice per phrase

6 - phrases

1000000 - checked passwords per second (super optimistic, unrealistic hardware, outside even government reach)

2 - half way through a hypothetical dictionary attack

60 - seconds per minute

60 - minutes per hour

24 - hours per day

365 - days per year

The comic was published on August 10, 2011 ;-)

By your numbers, Tr0ub4dor&3 will be decoded instantly but the xkcd one will still take hours

Reply on news.ycombinator.com