Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Isn't there research out there that proves long sentences and phrases are better than any random alpha numeric password


No. And preliminary research suggests that they are easier to crack.

http://arstechnica.com/security/2013/01/grammar-badness-make...

Legitimately randomly generated passwords still win, as long as the server uses a salt with bcrypt or iterated hashing like PBKDF1 or PBKDF2.


Well, you obviously have to define "long" and "any" in that sentence. The famous xkcd cartoon evaluates a four word "phrase" (four common random words) as 44 bits of entropy. But he's not comparing it to a random alpha-numeric string, he's comparing it to taking an uncommon word and doing a couple of letter substitutions to defeat complexity requirements.

A real random alpha-numeric password (what I get my password manager to generate, since I don't have to remember it) 12 characters long is more like 70 bits of entropy. You'd need 6 random words to match that. Essentially for every 2 random alphanumeric characters you need another random word.


Properly chosen pass phrases are very strong.

Most people cannot properly chose a pass phrase.

Use something like Diceware to generate a phrase.


If you read 128 bits of data from /dev/urandom, and then map the result to a space of 2128 possible passwords, then it doesn't actually matter what the possible passwords are, as long as it's a one-to-one mapping.


Do I get to cite this http://xkcd.com/936/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: