Tell me more ×
Skeptics Stack Exchange is a question and answer site for scientific skepticism. It's 100% free, no registration required.
up vote 3 down vote favorite

The author proposes that simple english phrases are not only easier to remember but more secure. The "information entropy" argument doesnt seem (IMO) to apply to a brute-force program chaining dictionary words.

Is his proposed solution more secure?

enter image description here

share|improve this question
3  
This was asked on security.se - security.stackexchange.com/questions/6095/… – Tom77 Aug 20 '12 at 12:40
I am more skeptical about the whole idea of good passwords. People discuss brute force speeds as if they have direct access to the data. In most cases (like logging into a site) an attacker will get 20 attempts at best. So even if your password is in the top 100 most common, it is unlikely to be guessed before locking out the account – Andrey Aug 20 '12 at 13:49
@Andrey In the relevant cases an attacker will not target single users but try to bruteforce a whole set of password hashes, eg a dump of some database. – Informaficker Aug 20 '12 at 17:26
The alt text on the original comic already answers this question - or at least hints at it: To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize. – Ian Dec 20 '12 at 13:52

closed as off topic by DJClayworth, Konrad Rudolph♦ Aug 20 '12 at 14:03

Questions on Skeptics Stack Exchange are expected to relate to scientific skepticism within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 2 down vote accepted

Assuming your hacker is using a dictionary of words instead of using character by character guessing, it would depend upon the size of the dictionary and if your words were in it.

If you assume that the dictionary has 1000 common words in it, and your words happened to be in that dictionary, then a combination formula would tell you that there are 41,417,124,750 possible combinations (You can learn about combination formulas at Mathwords).

Using the same formula with an 11 character password that has case differences and allows for numerical values and just the special characters above the numbers on the keyboard, you would get (62/11) or 508,271,323,092 combinations.

If the hacker's 1,000 guesses per second rule is valid, using this example, the character generated password would take longer to guess (16 years vs 1.3 years), however, if the dictionary were bumped up to a more reasonable 10,000 entries, it would take approximately 13,204 years to guess the password.

share|improve this answer
up vote 0 down vote

The comic more or less provide the proof, brute force dictionary chaining would still need to go over ~2^44 word combinations, making it a very secure password by virtue of using 4 different and independent words (even assuming the attacker knows about the 4 words scheme and rare words are not used).

The other scheme is harder to appraise objectively, but is in the same order of difficulty as claimed because it is based on rather limited manipulations of a single word.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.