Hacker News new | past | comments | ask | show | jobs | submit login

> especially given people tend to use common words

You don't pick the words yourself, you choose them at random. That's the whole point.

> Given the sort of compute power you can obtain cheaply nowadays, attacking 4-word schemas (especially given people tend to use common words) is not hard.

If the password is hashed with bcrypt with a work factor of 10 (the default in Rails), it would take ~5500 years to crack a single xkcd-style password on a single modern CPU core. Maybe 4 words aren't enough to protect you from the NSA, but they're enough to protect you from Joe Botnet and his db dump.




Except, how can you be sure your password was stored securely? You should never assume that.

> You don't pick the words yourself, you choose them at random. That's the whole point.

Suggest: you're supposed to choose them at random. In practice (source: 5 years as a security analyst) this does not happen. People are predictable!


> Except, how can you be sure your password was stored securely? You should never assume that.

You don't have to. You can use a password manager with an open protocol (like 1Password) where you can tell the db is encrypted using a key correctly and slowly derived from your master xkcd-style password.

If done correctly, it's a much better scheme than randomly generated characters because at the same level of entropy you wind up with a password you can actually remember and type quickly and use consistently in conjunction with a password manager.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: