# xkcd #936, Aug. 10, 2011 **URL:** \ **Category:** Cafe Society\ **Created:** [August 11, 2011, 12:22am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273 "2011-08-11T00:22:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Knorf](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Knorf](https://boards.straightdope.com/u/Knorf)\ **Post date:** [August 11, 2011, 12:22am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/1 "2011-08-11T00:22:17Z")
> **[Password Strength](https://xkcd.com/936/)** > > To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize. Is it true that it would be much better (in terms of minimizing automated guessability) to have a password like “correcthorsebatterystaple” than “Tr0ub4dor@3”? Even if the 1337-speak altered word weren’t a standard English word? ---
**Author:** ![Little\_Nemo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/little_nemo/32/3120_2.png) [@Little\_Nemo](https://boards.straightdope.com/u/Little_Nemo)\ **Post date:** [August 11, 2011, 12:51am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/2 "2011-08-11T00:51:42Z")
I found it hard to believe. On the other hand, I’m definitely somebody who doesn’t know information theory. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 12:59am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/3 "2011-08-11T00:59:13Z")
Why is is so hard to believe that a 25 character password is much better than a 11 character password. ---
**Author:** ![Knorf](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Knorf](https://boards.straightdope.com/u/Knorf)\ **Post date:** [August 11, 2011, 1:03am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/4 "2011-08-11T01:03:15Z")
What trips me up is the longer one being made of common English words, all lower case, with no numbers or symbols. I guess that doesn’t matter? If length is all there is to it, why aren’t we encouraged to use nothing but long chains of words, rather than mixes of upper and lower case letters, numbers, and symbols? ---
**Author:** ![guizot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guizot/32/3636_2.png) [@guizot](https://boards.straightdope.com/u/guizot)\ **Post date:** [August 11, 2011, 1:06am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/5 "2011-08-11T01:06:55Z")
> [@gazpacho](#): > > Why is is so hard to believe that a 25 character password is much better than a 11 character password. Is that really the question here? For me, the real myth is that supposedly something like the example in the comic (Tr0ub4dor) is easier to remember, but it’s not. I have one of those (that I can’t easily change) for a work email system, and half the time I type it in wrong. ---
**Author:** ![MobiusStripes](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@MobiusStripes](https://boards.straightdope.com/u/MobiusStripes)\ **Post date:** [August 11, 2011, 1:08am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/6 "2011-08-11T01:08:55Z")
> [@Knorf](#): > > What trips me up is the longer one being made of common English words. I guess that doesn’t matter? > > If length is all there is to it, why aren’t we encouraged to use nothing but long chains of words, rather than mixes of upper and lower case letters, numbers, and symbols? A lot of systems (sadly) still only support 8 characters (or at least minimal characters). I’ve found very few that support 25+ character passwords. Why this is is beyond me. That may account for the mixed case/non-alpha requirements in place now. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 1:09am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/7 "2011-08-11T01:09:04Z")
> [@](#): > > What trips me up is the longer one being made of common English words. I guess that doesn’t matter? > > If length is all there is to it, why aren’t we encouraged to use nothing but long chains of words, rather than mixes of upper and lower case letters, numbers, and symbols? It does matter if it was 25 characters of haxor stuff it would be much stronger than than the 44 bits of entropy. I don’t know about you but people have been pushing the idea of pass phrases instead of passwords for years and years. ---
**Author:** ![mikews99](https://avatars.discourse-cdn.com/v4/letter/m/ac91a4/32.png) [@mikews99](https://boards.straightdope.com/u/mikews99)\ **Post date:** [August 11, 2011, 1:10am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/8 "2011-08-11T01:10:07Z")
You can figure it out with simple math. Tr0ub4dor@3 contains 11 characters. Each character can contain a-z, A-Z, 0-9, and 31 punctuation characters accessible from the keyboard, for a total of 26+26+10+31 = 93 possible characters. So 93[sup]11[/sup], or 93_93_93_93_93_93_93_93_93_93_93 = 4.5x10[sup]21[/sup]. correcthorsebatterystaple has 25 characters. Each character can be a-z for 26 possible characters. 26[sup]25[/sup] = 2.37x10[sup]35[/sup], fourteen orders of magnitude greater than Tr0ub4dor@3. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [August 11, 2011, 1:11am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/9 "2011-08-11T01:11:43Z")
We’re always told “don’t use dictionary words, EVAR.” So why are you surprised that people are confused about this? Me, I keep a password app to store all my passwords - but I have to remember enter them there in the first place. :smack: Let me have 25+ character passwords and I’ll be all over passphrases. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 11, 2011, 1:15am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/10 "2011-08-11T01:15:03Z")
It’ll depend on the password-guessing process and on the method by which the words (in either case) are chosen. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 11, 2011, 1:19am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/11 "2011-08-11T01:19:13Z")
> [@](#): > > You can figure it out with simple math. > > Tr0ub4dor@3 contains 11 characters. Each character can contain a-z, A-Z, 0-9, and 31 punctuation characters accessible from the keyboard, for a total of… Both passwords have less entropy than that. You’re starting from the set of words in a dictionary, and a dictionary word only has as many bits as the log of the number of words in the dictionary. ---
**Author:** ![guizot](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guizot/32/3636_2.png) [@guizot](https://boards.straightdope.com/u/guizot)\ **Post date:** [August 11, 2011, 1:23am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/12 "2011-08-11T01:23:08Z")
> [@gazpacho](#): > > I don’t know about you but people have been pushing the idea of pass phrases instead of passwords for years and years. And I’ve always had that belief myself. And not just for statistical security, either. The more context to the language the easier it is to remember. That’s the nature of human cognition. For example, a password for The Straight Dope could be something extremely easy to remember, like: “whyareyouwastingyourtimewiththatwebsite” (or, as my girlfriend repeatedly says, “porquegastastantoenesavaina”), and I’d just like to see **that** be cracked with automated guessing. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 1:24am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/13 "2011-08-11T01:24:43Z")
> [@mikews99](#): > > You can figure it out with simple math. > > Tr0ub4dor@3 contains 11 characters. Each character can contain a-z, A-Z, 0-9, and 31 punctuation characters accessible from the keyboard, for a total of 26+26+10+31 = 93 possible characters. So 93[sup]11[/sup], or 93_93_93_93_93_93_93_93_93_93_93 = 4.5x10[sup]21[/sup]. > > correcthorsebatterystaple has 25 characters. Each character can be a-z for 26 possible characters. 26[sup]25[/sup] = 2.37x10[sup]35[/sup], fourteen orders of magnitude greater than Tr0ub4dor@3. You math is too simple. For a phase a given letter is not independent from the letters surrounding it as in your analysis. You are vastly over estimating the protection afforded by a pass phrase. Assuming a pool of 2048 words that can repeat. There are only 1.75[sup]13[/sup] choices. ---
**Author:** ![MobiusStripes](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@MobiusStripes](https://boards.straightdope.com/u/MobiusStripes)\ **Post date:** [August 11, 2011, 1:25am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/14 "2011-08-11T01:25:25Z")
> [@Chronos](#): > > Both passwords have less entropy than that. You’re starting from the set of words in a dictionary, and a dictionary word only has as many bits as the log of the number of words in the dictionary. From a character level lets say there is a-z, A-Z, 0-9 and (shifted)0-9. That’s.. 72 characters. But, the dictionary has a lot more than 72 words. Usually 10’s of thousands. So in the example, even there are only 4 words, isn’t is still harder to brute force? Replace one of the dictionary words with something non-dictionary and I’d think it’d be quite solid. ---
**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\ **Post date:** [August 11, 2011, 1:30am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/15 "2011-08-11T01:30:12Z")
“correcthorsebatterystaple” is better against a brute force attack – however, it is much less secure against a dictionary attack. We generally talk about suggesting good conventions, and in general you want conventions that are going to be the most secure. If you put it about that concatenating a small number of common words is good security, and people start doing it _en masse_, that would be trivially easy to exploit. Anyway, _good_ security locks out an account for a set interval after a relatively small number of wrong guesses, so either method is practically the same. I like to suggest reduced pass phrases, which are relatively secure and easy to remember. Include proper nouns, numbers, and punctuation in your seed phrase. Reduce the phrase to initial letters, keeping the proper nouns capitalized, and using numerals for numbers. EG: Snow White and the seven dwarves live together in sin! --\> SWat7dltis! George Lucas should never have made those last three Star Wars movies, eh? --\> GLsnhmtl3SWm,e? My first child, Stella Mae, is two years old. --\> mfc,SM,i2yo. They are easy to remember, and although they look awkward at a glance, after you hunt-and-peck them the first half-dozen times, they become easy to type in quickly. And ain’t no-one gonna guess them. ---
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [August 11, 2011, 1:35am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/16 "2011-08-11T01:35:25Z")
> [@Chronos](#): > > Both passwords have less entropy than that. You’re starting from the set of words in a dictionary, and a dictionary word only has as many bits as the log of the number of words in the dictionary. The common words dictionary on my computer has 98,000 words. So for a string of four words: 98,000^4=9.2E19. So two orders of magnitude less of a search space then 10 random characters. I think the XKCD guy is wrong in this case. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [August 11, 2011, 1:43am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/17 "2011-08-11T01:43:12Z")
Many password entry programs that I encounter have limitations that severely reduce security, and they are forced to rely upon being able to stop or slow down a password guesser before many tries. Even my bank allows only 8 chars max, and doesn’t allow _any_ special characters or spaces, so “purple monkey dishwasher” is out. The maxim about not using dictionary words is probably valid when you have only 8 chars. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [August 11, 2011, 1:55am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/18 "2011-08-11T01:55:12Z")
> [@Musicat](#): > > Even my bank allows only 8 chars max, and doesn’t allow _any_ special characters or spaces, so “purple monkey dishwasher” is out. The maxim about not using dictionary words is probably valid when you have only 8 chars. I think we’re with the same bank - either that or more than one huge financial institution has stupid password rules. They’re the ones I loathe the most in this respect. Ironically, they’re one of the few passwords that I put an extra password protection on in my password-listing app. That particular password has a dozen characters including special characters in it, so it is far more secure than the password it’s protecting. ☹ ---
**Author:** ![PetW](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@PetW](https://boards.straightdope.com/u/PetW)\ **Post date:** [August 11, 2011, 1:58am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/19 "2011-08-11T01:58:03Z")
Some of you seem to be overlooking that the comic is saying the computer guessing system is intelligent enough to realized that $ is often substituted for S, 0 for O, 4 or @ for A, etc. ---
**Author:** ![Bosstone](https://avatars.discourse-cdn.com/v4/letter/b/22d042/32.png) [@Bosstone](https://boards.straightdope.com/u/Bosstone)\ **Post date:** [August 11, 2011, 2:10am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/20 "2011-08-11T02:10:11Z")
Okay, so. A brute force attack is foiled by a longer password. A dictionary attack is foiled by random characters. So couldn’t something like hitchhikersguide2thegalaxy cut through both? [Next page](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273.md?page=2)