Hacker News Reader

Comment by fennecfoxen | Hacker News Reader

I also thought that particular XKCD comic was obsolete and debunked at this point. Modern password-crackers aren't ASCII-character-at-a-time and know about dictionary words (and all your 1337sp33k substitutions and trailing numbers).

View on HN

Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."

"The oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick." -- Bruce.

https://www.schneier.com/blog/archives/2014/03/choosing_secu...

I'm surprised that Schneier would make such a comment. Entropy is entropy, the "difficulty" estimates already except that attackers are fully aware of the method and the dictionary used.

Schneier is wrong if you are doing Diceware correctly. Schneier is more particularly wrong if you consider the point of the XKCD comic in the first place. What normal human anywhere is doing anything other than incrementing the required integer character (if they are even forced to rotate passwords in the first place)?

I think Schneier was assuming here that the user chooses the words himself rather than using a random generator. It's a fair assumption, given that most people won't actively seek out tools to help them make up passwords.

Reply on news.ycombinator.com