Re:The Devil Is in the Details of Project Verify’s Goal to E...
by jsjohnst on Friday October 05, 2018 @09:44AM
(#18148032)
> So in the end we only need to teach XKcd password strength vignette
I hate seeing XKCD style passwords being advocated like this all the time. If I know your password is “four English words”, it’s pretty much game over. While there are well over 100,000+ English words, the average English speaking person would draw from a list of about 5,000. 5,000^4 is only 625 trillion combinations. With GPU based password cracking easily topping 150B/sec these days (depending on algo), you can see how this isn’t as secure as you’d otherwise think.
I hate seeing XKCD style passwords being advocated like this all the time. If I know your password is “four English words”, it’s pretty much game over. While there are well over 100,000+ English words, the average English speaking person would draw from a list of about 5,000. 5,000^4 is only 625 trillion combinations. With GPU based password cracking easily topping 150B/sec these days (depending on algo), you can see how this isn’t as secure as you’d otherwise think.