Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think we agree that passwords should be adapted for their use case, but my point is also that in a lot of cases it's not motivated to use a password that "looks random" if you're going to have to type it in yourself.

"DWOW!psap.rair2vim" has ~118 Bits of entropy, but that's still less than this string (~129 bits):

> ggggg-eeeee-aaaaa-rrrrr

Remembering "the word gear, separated by hyphens in groups of 5" is trivial, and it's not a bad password. A lot of people think that it's a bad password because it "looks" insecure, but it's not: it's only insecure if the attacker has previous knowledge of the structure of the password, which they won't.

Of course it's not unthinkable that dictionary words with up to 10 repetitions separated by hyphens would be a part of some kind of generated dictionary list, but you can always "pad" the password, or do whatever else to make the structure that you came up with less predictable while still being memorable (to you), like:

> !ggggg-eeeee-aaaaa-rrrrr! (~147 bits)

> ggggg-eeeee!aaaaa-rrrrr (~135 bits)

You mention one of the things that is commonly understood as a "bad thing", which is "using words": that's not by itself a bad thing unless your password is the word, as soon as your password changes to "gear!" the dictionary needs to be expanded, the same goes for "gear!!!". Both of these are not good passwords, but my point here is that the fact that a word is included in some shape or form is not in itself a problem: if you have a password that's over 1,000 characters long composed of nothing but the word "gear" being repeated, that doesn't make it an easy password to crack with no prior knowledge.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: