Slashdot Mirror

There's an xkcd for that!

Looks like it's time to change my password to "password1".

I know this is just a joke, but we really need to stop propagating the idea that memorable passwords are weak.

The brute force search space of "password1" is 486 times larger than "password" (36^9 versus 26^8). Increasing the length of a password is one of the best ways to strengthen it. Intuitively, a randomized string is better than a structured one. This is correct, but only when the strings have equal length. Humans cannot remember long randomized strings. A lengthy, structured password is stronger against computerized attacks since the search space is significantly larger.

According to Princeton's WordNet there are at least 117,000 English nouns. A memorable four-noun phrase has a search space 2600 times larger than a randomized 7-bit ASCII eight-character password (117000^4 versus 128^8).

An obligatory XKCD with discussion can be found here.

You sound like someone who hasn't seen this yet, but would enjoy it.

So, can someone explain the hover comment in that one?

Yes, someone can.