# Question about Passwords - Is XKCD right? **URL:** \ **Category:** Factual Questions\ **Created:** [July 2, 2022, 2:27pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301 "2022-07-02T14:27:00Z")\ **Posts on this page:** 20\ **Page:** 6
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [July 5, 2022, 11:45am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/101 "2022-07-05T11:45:01Z")
> [@md-2000](#): > > Yes, as the discussion of security by obscurity - if they have no idea your “trick” then they have a plethora of options to try, none of which are trivial. If somehow they know your trick, then the range of guesses they have to try diminishes significantly. > … All quite true. But I think a useful taxonomy is “Attacks directed at you specifically by name because of who you are or what you have or what they already know about you”, versus “Attacks directed equally at every user of website X, of whom you happen to be one of thousands or millions.” Here in 2022 unless someone is rich, prominent, or a high official in business or government, the former type of attacks are by far the statistical outlier. And those are the attacks for which the defender giving up some obscurity directly helps the attacker. This is like them fishing with spear watching a particular fish. a fish named “you”. The far more common attack technique is more like sea-floor trawling: drop a huge net and drag up everything it touches, be that fish, by-catch fish, rocks, or old ship parts. Then dig through the haul & keep whatever looks valuable. In that mass-production form of thievery or espionage, no person or computer program is particularizing their attack against username Joe\_Jones. He’s getting the same treatment as the other 100,000 or 100,000,000 users in the stolen database. Whether or not Joe ever posted online that he preferred 133+speek!$# passwords over 5-English words passwords is immaterial. One can make a good argument that there’s zero upside and to sharing your PW technique, so why do it? Any impact at all is sure to be to the downside, microscopic though it might be. And that is a _logically_ valid argument. But … for an ordinary schlub such as myself and presumably most Dopers, it’s IMO a _practically_ useless argument; it’s making a distinction that fails to rise to a level of making a difference. YMMV of course. A separate issue is one’s work login credentials versus personal ones. I might be a totally ordinary schlub in the public / internet world, but at the same time be immersed in vicious office politics at work, with semi-psycho cow-orkers desparately trying to discredit me or get me fired. IOW, in a sufficiently small pond I may well be a big enough fish to be specifically targetted. That cow-orker is a threat of the first kind above and deserves one’s best efforts at both PW quality and at secrecy about one’s methodologies. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [July 5, 2022, 11:50am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/102 "2022-07-05T11:50:18Z")
My issue is with the claim that any four random words are easy to remember. I do not find it that way, especially once you have to generate even a small number of passwords. I never can actually even remember the four words in the comic, which Munroe says you’d have memorized before you finish reading it. Password managers are fine. Sure, it does put all your eggs in one basket, but then that just means that one basket needs to be quite secure. I use Chrome’s built in system, which is locked to you having to use Chrome and log in to my account, where I have two-factor enabled. Google knows security and doesn’t leave their files where they can be easily leaked or cracked. Due to the whole “reset your password with email” system, your eggs are always in one basket anyways. Might as well make it a secure one. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [July 5, 2022, 10:26pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/103 "2022-07-05T22:26:21Z")
I understood the claim as being that it is easier to create a decent mnemonic for 4–5 words than for an equivalent amount of ASCII garbage. Whether or not that is true is another question, but I would not dismiss it as preposterous. ---
**Author:** ![Senegoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/senegoid/32/6606_2.png) [@Senegoid](https://boards.straightdope.com/u/Senegoid)\ **Post date:** [July 6, 2022, 5:05am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/104 "2022-07-06T05:05:00Z")
> [@BigT](#): > > My issue is with the claim that any four random words are easy to remember. I do not find it that way, especially once you have to generate even a small number of passwords. I never can actually even remember the four words in the comic, which Munroe says you’d have memorized before you finish reading it. That XKCD has been around for several years, and I _still_ can’t remember “correct horse battery staple”. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [July 6, 2022, 11:47am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/105 "2022-07-06T11:47:26Z")
> [@DPRK](#): > > I understood the claim as being that it is easier to create a decent mnemonic for 4–5 words than for an equivalent amount of ASCII garbage. Whether or not that is true is another question, but I would not dismiss it as preposterous. ⁢ I dismissed it (for myself, mind you) because I tried it and could not do it. It’s easy when you start with a meaningful passphrase, but much harder when you don’t. Based on my experience, I don’t find it necessarily preposterous, just dubious. Then again, I’m really bad with mnemonics, always forgetting words in them. Heck, I’d actually forgotten there was a mnemonic in the comic until I just checked it (to make sure I hadn’t misremembered that last line). ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 6, 2022, 12:52pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/106 "2022-07-06T12:52:53Z")
OK, so some folks won’t easily remember four words. Now I ask those of you: Do you remember the other sample password in that comic? ---
**Author:** ![DesertDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/desertdog/32/11503_2.png) [@DesertDog](https://boards.straightdope.com/u/DesertDog)\ **Post date:** [July 6, 2022, 7:51pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/107 "2022-07-06T19:51:38Z")
> [@Senegoid](#): > > That XKCD has been around for several years, and I _still_ can’t remember “correct horse battery staple”. OTOH, on another board, someone put up the cartoon’s URL and I came up with the phrase in my mind even as I was clicking on the link. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [July 6, 2022, 9:08pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/108 "2022-07-06T21:08:28Z")
How about this dopers… We all have those favorite movies, and also ear worm songs. Pick out a line from the movie or song, maybe two. And use the first (or last) letter of each word. Easy to remember for the user. If you forget, you may have to think for a minute. eemtsanoetiwsst \< That’s not one of my passwords. But it uses the reasoning I laid out above. ---
**Author:** ![EinsteinsHund](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/einsteinshund/32/8400_2.png) [@EinsteinsHund](https://boards.straightdope.com/u/EinsteinsHund)\ **Post date:** [July 6, 2022, 9:19pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/109 "2022-07-06T21:19:40Z")
> [@enipla](#): > > How about this dopers… We all have those favorite movies, and also ear worm songs. > > Pick out a line from the movie or song, maybe two. And use the first (or last) letter of each word. > > Easy to remember for the user. If you forget, you may have to think for a minute. I have a similar, but even more convoluted method derived from my love of music. I won’t tell or else I’d have to kill you all… 😆 ---
**Author:** ![k9bfriender](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/k9bfriender/32/3283_2.png) [@k9bfriender](https://boards.straightdope.com/u/k9bfriender)\ **Post date:** [July 6, 2022, 9:33pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/110 "2022-07-06T21:33:06Z")
> [@enipla](#): > > Pick out a line from the movie or song, maybe two. Just don’t pick the line that you remember from the movie, as it is probably the base for hundreds of people’s passwords. I’m sure there are a bunch of agamwiwngha, itssiynwygcgg, or even witcotbhah 's out there. ---
**Author:** ![k9bfriender](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/k9bfriender/32/3283_2.png) [@k9bfriender](https://boards.straightdope.com/u/k9bfriender)\ **Post date:** [July 6, 2022, 9:34pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/111 "2022-07-06T21:34:55Z")
My technique for high level passwords is that I used to have a habit of memorizing out of state license plates. So, I have a whole list of license plates in my head, and I’ll pick two of them. ---
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [July 6, 2022, 9:37pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/112 "2022-07-06T21:37:34Z")
> [@k9bfriender](#): > > Just don’t pick the line that you remember from the movie, as it is probably the base for hundreds of people’s passwords. Going along with the general principle that your tastes aren’t as quirky and unique as you think you are. Your favourite line is a lot of people’s favourite line. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [July 6, 2022, 9:39pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/113 "2022-07-06T21:39:03Z")
For memorizable passwords, the simplest solution is to use an acronym (first letter of each word) of a moderately long phrase. That gives you a near-random string of letters\* short enough to be accepted by most password prompts but information-dense enough to be secure. Add a few more rules to cover poorly designed sites that insist on mixed-case and digits (e.g. "Capitalize anything that was capitalized in the original phrase, tack on the number of letters in the final word). \*I did a Shannon entropy calculation of a string of first letters collected from a couple of books and got a value of 4.07 bits of entropy per letter (compared to log2(26) = 4.70 bits of entropy for truly random letters) Edit: As noted above, don’t use a phrase from some common bit of pop culture, etc. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [July 6, 2022, 9:42pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/114 "2022-07-06T21:42:29Z")
> [@k9bfriender](#): > > My technique for high level passwords is that I used to have a habit of memorizing out of state license plates. So, I have a whole list of license plates in my head, and I’ll pick two of them. k9, you need a hobby. 😉 ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 6, 2022, 9:44pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/115 "2022-07-06T21:44:43Z")
Sounds like he already has one. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [July 6, 2022, 9:45pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/116 "2022-07-06T21:45:20Z")
> [@Steve\_MB](#): > > For memorizable passwords, the simplest solution is to use an acronym (first letter of each word) of a moderately long phrase. Agree. If it gets to the point that we have to digitize pictures of lava lamps along with leaves blowing in the wind, well, I’m gonna retire. I’m almost there anyway. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [July 6, 2022, 10:03pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/117 "2022-07-06T22:03:46Z")
> [@enipla](#): > > If it gets to the point that we have to digitize pictures of lava lamps… For those who didn’t get the reference, Cloudflare uses lava lamps to generate random numbers. “LavaRand” was originally proposed as a joke at Silicon Graphics in the 90s before they actually built it, and Cloudflare built their own when SG’s patent expired. It might be overkill for generating your own passwords, but it’s an option. > **[LavaRand in Production: The Nitty-Gritty Technical Details](https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/)** > > There's a wall of lava lamps in the lobby of our San Francisco office. We use it for cryptography. Here are the nitty-gritty technical details. ---
**Author:** ![enipla](https://avatars.discourse-cdn.com/v4/letter/e/54ee81/32.png) [@enipla](https://boards.straightdope.com/u/enipla)\ **Post date:** [July 6, 2022, 10:31pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/118 "2022-07-06T22:31:03Z")
> [@TroutMan](#): > > It might be overkill for generating your own passwords, but it’s an option. Thanks TroutMan. I posted that ‘somewhere’ or saw it here. I actually mentioned it to my crew and said that I’ll never complain about strong pwd’s again. Yeah, way overkill, but it’s ‘sexy’. I could digitize pictures of my dogs and get the same pwd strength. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 7, 2022, 1:23pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/119 "2022-07-07T13:23:44Z")
> [@enipla](#): > > I could digitize pictures of my dogs and get the same pwd strength. Well, that depends on how much time your dogs spend sleeping. ---
**Author:** ![smithsb](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/smithsb/32/12107_2.png) [@smithsb](https://boards.straightdope.com/u/smithsb)\ **Post date:** [July 7, 2022, 4:25pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/120 "2022-07-07T16:25:31Z")
Can you use a QR code for a password? Or a barcode? [Previous page](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301.md?page=5) [Next page](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301.md?page=7)