# xkcd #936, Aug. 10, 2011 **URL:** \ **Category:** Cafe Society\ **Created:** [August 11, 2011, 12:22am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273 "2011-08-11T00:22:17Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [August 11, 2011, 2:15am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/21 "2011-08-11T02:15:51Z")
> [@PetW](#): > > Some of you seem to be overlooking that the comic is saying the computer guessing system is intelligent enough to realized that $ is often substituted for S, 0 for O, 4 or @ for A, etc. I think he’s overestimating how many people use the formula he gives to generate a password though. If a lot of people use a common word with l337 speak substitutions and a random two character punctuation-number string on the end, he’s right. But I don’t think that formula, vs many other variations is really that dominant. (plus he assumes that the first letter is the only one that may or may not be capitalized that only three letters in any word will be substitutable, and that for each such letter, there’s only one possible substitution). ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 2:15am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/22 "2011-08-11T02:15:59Z")
> [@Simplicio](#): > > The common words dictionary on my computer has 98,000 words. So for a string of four words: 98,000^4=9.2E19. So two orders of magnitude less of a search space then 10 random characters. > > I think the XKCD guy is wrong in this case. Lets follow the math in the comic. There are two methods of generating passwords presented. Lets calculate how many possible passwords we can generate with the two methods. Method 1 1. Choose an uncommon word. In the comic he assumes a space of 65536 words or 16 bits entropy 2. choose to capitalize it or not. 2 choices 3. make a leet speek substitution for 3 of the letters. 2 choices for each letter 8 total choices. You could argue that there are a lot more than 8 choices but it won’t make much different in the end. 4. add some punctuation at the end 16 choices 5. add a number at the end 8 choices 6. choose to flip the number and punctuation 2 choices. 65536_2_8_16_8=1.3 \*10[sup]8[/sup] possible passwords Method 2 1. Choose 4 common English words assume 2048 words to choose from do not repeat words. 2048_2047_2046\*2045=1.75[sup]13[/sup] possible pass phrases. Method 2 has vastly more possible choices. The ease of memorization is more subjective but I think Method 2 is easier to remember. ---
**Author:** ![Rick](https://avatars.discourse-cdn.com/v4/letter/r/9f8e36/32.png) [@Rick](https://boards.straightdope.com/u/Rick)\ **Post date:** [August 11, 2011, 2:20am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/23 "2011-08-11T02:20:30Z")
> [@Larry\_Mudd](#): > > “correcthorsebatterystaple” is better against a brute force attack – however, it is much less secure against a dictionary attack. We generally talk about suggesting good conventions, and in general you want conventions that are going to be the most secure. If you put it about that concatenating a small number of common words is good security, and people start doing it _en masse_, that would be trivially easy to exploit. > > Anyway, _good_ security locks out an account for a set interval after a relatively small number of wrong guesses, so either method is practically the same. > > I like to suggest reduced pass phrases, which are relatively secure and easy to remember. > > Include proper nouns, numbers, and punctuation in your seed phrase. > Reduce the phrase to initial letters, keeping the proper nouns capitalized, and using numerals for numbers. > > EG: > > Snow White and the seven dwarves live together in sin! –\> SWat7dltis! > > George Lucas should never have made those last three Star Wars movies, eh? –\> GLsnhmtl3SWm,e? > > My first child, Stella Mae, is two years old. –\> mfc,SM,i2yo. > > They are easy to remember, and although they look awkward at a glance, after you hunt-and-peck them the first half-dozen times, they become easy to type in quickly. And ain’t no-one gonna guess them. This is very similar to what I tell people about how to create a very secure password. My suggestion is to take the lyrics to a song you know by heart and use the first two or three lines and reduce it to letters Oh say can you see By the dawn’s early light Becomes OscysBtdel and you can leave a piece of paper in plain sight with the password hint “Key” or “Oh say” ---
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [August 11, 2011, 2:25am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/24 "2011-08-11T02:25:51Z")
> [@gazpacho](#): > > Method 2 has vastly more possible choices. The ease of memorization is more subjective but I think Method 2 is easier to remember. I guess I’m not convinced that peoples random characters and letters type passwords follow formulas that are that predictable. But in anycase, do most computer servers really let users try to log on a thousand times a second? That seems a much easier security hole to fix then making everyone either type in a long four word password or a random string of alphanumerics. Just lock a user out for an hour if they have 30 failed login attempts. ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [August 11, 2011, 2:30am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/25 "2011-08-11T02:30:02Z")
> [@Simplicio](#): > > So two orders of magnitude less of a search space then 10 random characters. > > I think the XKCD guy is wrong in this case. > [@PetW](#): > > Some of you seem to be overlooking that the comic is saying the computer guessing system is intelligent enough to realized that $ is often substituted for S, 0 for O, 4 or @ for A, etc. **THIS**. Those of you who are talking about things like “10 random characters” are missing xkcd’s point. Something like “Tr0ub4dor@3” is not just 10 random characters. It is a word, with some relatively standard modifications, which could be “easily” guessed by brute-force methods that check all common modifications to all dictionary words. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 2:42am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/26 "2011-08-11T02:42:10Z")
> [@Simplicio](#): > > I guess I’m not convinced that peoples random characters and letters type passwords follow formulas that are that predictable. I agree people’s choices are much much easier to predict. 65000 words please it is much much less. > [@](#): > > But in anycase, do most computer servers really let users try to log on a thousand times a second? That seems a much easier security hole to fix then making everyone either type in a long four word password or a random string of alphanumerics. Just lock a user out for an hour if they have 30 failed login attempts. A big commercial site has to be a little more creative than that. If I am a mad hacker with my legion of zombie computers at my bidding I could bring down bank of america’s online banking by trying to brute force a large number of accounts from my thousands of computers by trying to log into millions of different accounts by trying all the passwords. The big websites are under attack like this all the time. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 2:54am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/27 "2011-08-11T02:54:08Z")
Simplicio, I am being too snarky. BOTH passwords in the comic are very good passwords, the pass phrase is better but both are better than most people use. The question is which is easier for the end user to remember. ---
**Author:** ![Left\_Hand\_of\_Dorkness](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/left_hand_of_dorkness/32/7156_2.png) [@Left\_Hand\_of\_Dorkness](https://boards.straightdope.com/u/Left_Hand_of_Dorkness)\ **Post date:** [August 11, 2011, 3:07am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/28 "2011-08-11T03:07:43Z")
> [@Simplicio](#): > > But in anycase, do most computer servers really let users try to log on a thousand times a second? That seems a much easier security hole to fix then making everyone either type in a long four word password or a random string of alphanumerics. Just lock a user out for an hour if they have 30 failed login attempts. I talked with a university IT guy about that awhile ago. He said that as soon as you implemented that, disgruntled students would keep their professors permanently locked out of their accounts with a simple script. They allow infinite login attempts, but require profs to switch passwords all the time. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 11, 2011, 3:11am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/29 "2011-08-11T03:11:21Z")
Quoth **Simplicio** : > [@](#): > > The common words dictionary on my computer has 98,000 words. So for a string of four words: 98,000^4=9.2E19 Which is 66 bits of entropy, considerably better than the comic says (Munroe is apparently considering the set of “common words” to only have about 2000 members). ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 11, 2011, 3:13am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/30 "2011-08-11T03:13:26Z")
> [@](#): > > They allow infinite login attempts, but require profs to switch passwords all the time. A very popular tactic, which accomplishes nothing at all for security. If an attacker breaks in, he’s going to change the password immediately, not wait until 90 days later. Meanwhile, you’re guaranteeing the presence of post-it notes stuck to monitors which a student could glance at during office hours. ---
**Author:** ![Kobal2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kobal2/32/20_2.png) [@Kobal2](https://boards.straightdope.com/u/Kobal2)\ **Post date:** [August 11, 2011, 3:24am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/31 "2011-08-11T03:24:13Z")
> [@Thudlow\_Boink](#): > > **THIS**. Those of you who are talking about things like “10 random characters” are missing xkcd’s point. Something like “Tr0ub4dor@3” is not just 10 random characters. It is a word, with some relatively standard modifications, which could be “easily” guessed by brute-force methods that check all common modifications to all dictionary words. So you use h4x0r transpositions on made-up words that are not in common dictionaries, or even the Wikipedia index. Easy to remember, hard to crack. Problem solved. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 3:27am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/32 "2011-08-11T03:27:29Z")
> [@Chronos](#): > > A very popular tactic, which accomplishes nothing at all for security. If an attacker breaks in, he’s going to change the password immediately, not wait until 90 days later. Meanwhile, you’re guaranteeing the presence of post-it notes stuck to monitors which a student could glance at during office hours. A big question is who is the bigger security risk. The mad hacker with his 10,000 zombie computers at his bidding or the 150 students the professor has that semester that come in for office hours. It is not obvious to me who is to worse threat. But a pass phrase instead of a 8 to 12 character password is better against both. ---
**Author:** ![Taomist](https://avatars.discourse-cdn.com/v4/letter/t/53a042/32.png) [@Taomist](https://boards.straightdope.com/u/Taomist)\ **Post date:** [August 11, 2011, 3:41am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/33 "2011-08-11T03:41:07Z")
I inadvertently did the phrase thing with my password. I worked for an online company that required changing passwords every two weeks; the only upside was that we were allowed to repeat passwords. The first was randomly generated, and for some reason was really easy for me to remember, so I switched back and forth with a variant of that for so long that I started using it, and variations, for most of my personal passwords. The original passwords were all 3 letters followed by 5 numbers. A couple of years go by and I meet Mr. Tao, called Defiant for simplification purposes. After about another year, I realized that the three letters of my password equated to Tao Loves Defiant. Cute! Kept using the password; even easier to remember now! Time passes and we marry. About a month ago I realized that the 5 digits of my password are our wedding date. :eek::eek:😛 Psychic random password generator, indeed. ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [August 11, 2011, 3:43am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/34 "2011-08-11T03:43:54Z")
A somewhat related question–why has 8 characters been decided on as the standard minimum length? Back when people were still debating overlays vs splits for new area codes, I recall claims that human memory worked best at seven items. I have no idea if this is true or not, though I have noticed that my preferred method of creating completely random letter/number/symbol combinations and memorizing though repetition seems to work best at 7 characters. ---
**Author:** ![kaylasdad99](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kaylasdad99/32/3398_2.png) [@kaylasdad99](https://boards.straightdope.com/u/kaylasdad99)\ **Post date:** [August 11, 2011, 3:47am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/35 "2011-08-11T03:47:44Z")
> [@Knorf](#): > > What trips me up is the longer one being made of common English words, all lower case, with no numbers or symbols. I guess that doesn’t matter? > > If length is all there is to it, why aren’t we encouraged to use nothing but long chains of words, rather than mixes of upper and lower case letters, numbers, and symbols? Probably because we’re conditioned to think that we’re protecting ourselves against hacking by a lone malicious human with a keyboard, rather than by someone determined enough to deploy a computer. ---
**Author:** ![Jragon](https://avatars.discourse-cdn.com/v4/letter/j/e19b73/32.png) [@Jragon](https://boards.straightdope.com/u/Jragon)\ **Post date:** [August 11, 2011, 3:49am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/36 "2011-08-11T03:49:00Z")
Another issue is that the password guessing difficulty is actually affected by requirements. A (sufficiently random) password that is purely alphanumeric is more or less equally as safe as a password with symbols in an environment that allows symbols in passwords. Similarly, allowing capitals actually increases security for those who don’t use capitals. In other words, given an identical environment (let’s say alphabetic characters, capital or lower case), these expressions are relatively equally secure: aqrzttghy BnQrTTUvP GHBVVJUIO because in that environment you have to test for capitals, since they’re allowed. So a password environment that allows a larger range is inherently more secure than an environment that doesn’t allow a large variance, it can even slow down dictionary attacks since in more complex environments they’re required to take into account k00l l3tter substitoosh()nz, in addition to the usual “clever” letter swaps. ---
**Author:** ![CaveMike](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cavemike/32/16379_2.png) [@CaveMike](https://boards.straightdope.com/u/CaveMike)\ **Post date:** [August 11, 2011, 4:22am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/37 "2011-08-11T04:22:05Z")
This article has been making the rounds in July and may have been the inspiration for the comic: > **[The Usability of Passwords](https://www.baekdal.com/thoughts/password-security-usability/)** It basically says a longer, simple password is more secure than a shorter, complex password. And since it is easy to remember, you won’t expose it on a post-it. (I realize others have made this point, but I wanted to include the link and some context.) ---
**Author:** ![Knorf](https://avatars.discourse-cdn.com/v4/letter/k/58956e/32.png) [@Knorf](https://boards.straightdope.com/u/Knorf)\ **Post date:** [August 11, 2011, 4:24am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/38 "2011-08-11T04:24:31Z")
> [@kaylasdad99](#): > > Probably because we’re conditioned to think that we’re protecting ourselves against hacking by a lone malicious human with a keyboard, rather than by someone determined enough to deploy a computer. Well, I’ve more or less always assumed that if someone was determined, they would be able to hack anything I have password-protected. Just like, if someone really wants to, they could break into my house. I’m mainly hoping to deter the casual break-ins. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [August 11, 2011, 4:28am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/39 "2011-08-11T04:28:41Z")
> [@Larry\_Mudd](#): > > “correcthorsebatterystaple” is better against a brute force attack – however, it is much less secure against a dictionary attack. We generally talk about suggesting good conventions, and in general you want conventions that are going to be the most secure. If you put it about that concatenating a small number of common words is good security, and people start doing it _en masse_, that would be trivially easy to exploit. > > Anyway, _good_ security locks out an account for a set interval after a relatively small number of wrong guesses, so either method is practically the same. > > I like to suggest reduced pass phrases, which are relatively secure and easy to remember. > > Include proper nouns, numbers, and punctuation in your seed phrase. > Reduce the phrase to initial letters, keeping the proper nouns capitalized, and using numerals for numbers. > > EG: > > Snow White and the seven dwarves live together in sin! –\> SWat7dltis! > > George Lucas should never have made those last three Star Wars movies, eh? –\> GLsnhmtl3SWm,e? > > My first child, Stella Mae, is two years old. –\> mfc,SM,i2yo. > > They are easy to remember, and although they look awkward at a glance, after you hunt-and-peck them the first half-dozen times, they become easy to type in quickly. And ain’t no-one gonna guess them. It’s even better, although slightly harder to remember, if you change the number so that the sentence is false. So your examples might become something like this: Snow White and the seventeen dwarves live together in sin! –\> SWat17dltis! George Lucas should never have made those last eighty six Star Wars movies, eh? –\> GLsnhmtl86SWm,e? My first child, Stella Mae, is nine hundred twenty three years old. –\> mfc,SM,i923yo. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 11, 2011, 4:55am UTC](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273/40 "2011-08-11T04:55:42Z")
> [@Ferret\_Herder](#): > > We’re always told “don’t use dictionary words, EVAR.” So why are you surprised that people are confused about this? > > Me, I keep a password app to store all my passwords - but I have to remember enter them there in the first place. :smack: Let me have 25+ character passwords and I’ll be all over passphrases. In this day and age you really need the password app. You need to have different passwords for every thing. Or at least every thing that is likely to be attacked. Your email, banking, credit card and facebook passwords should all be different. You things that don’t matter much or are not as popular can have the same passwords. It is not that big a deal if go comics is hacked and my list of comics that are emailed every day is screwed up. But if they get my password and email address from gocomics and start logging into gmail, the big banks with my gocomics username and password it would be very bad if they gained access to these accounts. The mad hackers this summer got that sort of information from Sony. I am sure that a lot of Sony customers had to spend time sorting out banking and credit card charges based on the reuse of login names and passwords. correcthorsebatterystaple is not in my dictionary. Not that I don’t see your point. But the requirement is that your password not be a dictionary word, not that it is made up of dictionary words. It is a subtle distinction that is easily lost in the rule of thumb advice people have to remember about a large number of things that they do in life. [Previous page](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273.md?page=1) [Next page](https://boards.straightdope.com/t/xkcd-936-aug-10-2011/592273.md?page=3)