▲ 30 points
back
21 comments
Just 3 words will not make a safe password. People are asking in comments why, so let me try to offer an explanation.
First of all, we don't know how large is the dictionary. @Symbiote mentioned 132k words, but typically for diceware method (a method where you randomly select words from a dictionary) only 7776 are used (why so few? because then it's easier to select the words by rolling an actual dice). Nevertheless, let's assume 170k for now. Nowadays you can crack 100-500 GH/s (100*10^9) [1] at home (you need $25000 for the hardware, but let's assume a rich household ;))
So we have (132k^3) / (100 GH/s) = 23000 seconds [2]. That's less than 7 hours!
You could argue that nowadays everyone uses bcrypt, so such speeds are not possible. The question is: are you really sure that no one uses md5 any longer?
[1] https://gist.github.com/epixoip/ace60d09981be09544fdd3500505...
[2] https://www.wolframalpha.com/input/?i=%28132000%5E3+hashes%2...
Being difficult to pronounce for English-speakers doesn't make dictionary words secure!
Fortunately, the web page itself suggests as much, but it's worth reiterating. Don't use these amusing passwords, please!
Realistically, though, how many people do you think have compiled rainbow tables against a Welsh dictionary?
It only takes one, and the idea has been floating around twitter for quite a while, as the linked web page mentions.
Javanese then?
Probably more than zero, now ;)
What is wrong with this password, for example?
>RoliedigHembryonauCarmeliaid6
Seems pretty consistent with XKCD's comic on passwords.
If you're using something like "CorrectHorseBatteryStaple6" and consider it a secure password, I have some bad news for you.
I dunno, I just did some back-of-the-envelope calculations and it seems to be okay:
With 8 high-end GPUs, we see a Blowfish speed of about 100 kilohashes per second. [0]
We assume we're cracking bcrypt strength 10, so we divide this number by 64 (2^10 ÷ hashcat's 2^4), and get about 1500 bcrypt checks-per-second.
There are about 170,000 words in the OED, and we choose 4 at random to give us 170_000^4 = 8.3521 * 10^20.
We can divide by 1500, but that still seems like a lot of seconds. (like, 3.5 ages of the sun)
[0]: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Unless the hash is in a cookie or something I probably couldn't guess it either within the lifetime of the sun etc.
It's got 80-120 ish bits of entropy, why is it not secure?
(Assuming you're not referring to it literally being a well known password from a web comic.)
Not the parent poster, but prior objections I've seen are that people don't do a good job at picking random words and four words is too few.
I assumed they meant using a diceware-like system to choose instead of literally making up words
> I have some bad news for you
Can you expand on that?
The Welsh OpenOffice dictionary¹ seems to include 132,000 words.
ln₂(132000) = 17, and there are three words, so 41 bits -- almost as good as the smaller dictionary but four words of "Correct Horse Battery Staple".
(This is a rough estimate, I haven't looked at the dictionary in detail to see if there are many very similar words etc.)
[1] https://extensions.openoffice.org/en/project/gwirydd-sillafu...
That is a funny and clever site.
I prefer my padding method [1] for greater entropy.
This is funny but is the opposite of the idea espoused in the correcthorsebatterystaple xkcd. Welsh words are hard for (most) humans to remember, but easy for machines to check (since wordlists are publicly available)
But surely word lists are publically available for English words too?
Yes. Diceware is one such, the EFF has some improved variants. With 7776 words you can roll 5 dice and get a number, which becomes a word. log(7776)/log(2) = ~13, so 13 bits of entropy per word chosen. 7 words for 91 bits of entropy (over the 80-bit absolute minimum for decent security of a key), 10 for 130 bits of entropy (better than 128-bits that lots of people use for AES), 20 for 260 bits (better than 256, enough to resist even batch attacks by enormously powerful actors).
Of course a 20 random word string is less a "password" or "passphrase" and more a "passpoem". You only want one or two of those, as master passwords for a password manager.
Correct, but one facet of xkcd passwords is that it's very easy to remember which prevents people from writing down passwords on sticky notes, thus eliminating that security risk.
In the case of Welsh words, it's about as easy to remember for a non-Welsh speaker as leetspeak is, and so people will just write down the password somewhere again to remember it, which makes this less secure overall than xkcd passwords on English.
I tried to see the Twitter of the creator and it turns out I'm blocked.