Multiword Passwords Secure Or Not?

Gaygirlie writes "An article over at Gizmag says: 'It's a meme that's been doing the rounds on the internet in recent years: multi-word pass-phrases are as secure as long strings of gibberish but with the added benefit of being easy to remember. But research from Cambridge University suggests that this may not be the case. Pass-phrases comprised of dictionary words may not be as vulnerable as individual passwords, but they may still succumb to dictionary attacks, the research finds.' I find this to be twisting of words and general consensus; of course any password whatsoever is going to be insecure against offline attack, and using common, popular words is going to make guessing the password much easier. But is this really an issue in a world where most attacks are done online? Should general populace still be coaxed into using randomly generated passwords?"

Comments

Re:Obligatory xkcd

[gstoddart]

There is something that always bothered me, how in the hell does the attacker knows if I am using words for my password or not?

They don't, but if they have the resources for a brute-force search, it's moot since in theory they'll just keep trying until they find it.

Second consider the following password where at one point was on my laptop: "A happy worker is mindless worker, so shut up and do your job!" I fail to see how this password is not safe just because I used actual words, wouldn't it take million of years(even with dictionary attack) to gess it ?

Well, possibly not. Think about a document with a password.

If someone really wants to get into it, and is willing to invest the time and hardware, having a computer try millions and millions of permutations isn't as expensive as you might think, and it gets cheaper every year.

Many forms of crypto have fallen over the years as the speed of computers has allowed what used to be an impossible task to be something which can be done in relatively short time. Even a couple of days or weeks of compute time would represent an absolutely vast amount of attempts.

It's a damned find pass-phrase, but a computer is really good at doing an endless set of boring things. So, eventually even if it's a massive brute force attack, it could still arrive at the one that worked.

However, this is the most telling part:

The researchers found that film and book titles were effective in identifying pass-phrases in use - information readily available in list-form online suitable for dictionary-style attacks. The researchers used Wikipedia and IMDB lists, as well as slang phrases from Urban Dictionary. Researchers found users tended to favor simple two-word phrases common in natural language, though there is evidence that some users seek out seemingly-random pairings. The researchers also claim that there are "rapidly diminishing returns" for longer pass-phrases containing three or four words.

So, if movie names and slang is what many people are using as their pass-phrases, a dictionary attack is a little easier.

But, something like "cotillion squirrel hammer bollocks gouda inkwell" might be random enough that the sources people might use to try a dictionary attack won't be of any help. Whereas "The Dark Knight" or "Star Wars" might fall pretty quickly.

Re:Obligatory xkcd

[Geoffrey.landis]

So you didn't bother to RTFA before posting that. They're trying to show that the easier to remember password may be easier to crack with a dictionary attack.

And you didn't bother to read the xkcd before posting that. It showed with calculations that the commonly used "hard to remember" password has lower entropy than a much easier to remember multiword phrase. For reference, "higher entropy" means "harder to crack with a tailored brute force attack."

In any case, though, the actual first thing you need to do is to make sure you never reuse a password on two different systems. And the xkcd for that is http://xkcd.com/792/

Re:Obligatory xkcd

[Anonymous Coward]

> Say you have a 4 word password and you publish your 2048 word dictionary on the internet, entitled "come at me". Is that more or less secure than a random 8 character password(upper, lower, numbers, 40 symbols)

> 4^2048 vs 8^102

You mean 2048^4 vs 102^8.

2048^4 = 1.7592186 * 10^13
102^8 = 1.17165938 * 10^16

With only a 2048 word dictionary to choose from this is less secure than a random 8 character password.

Re:Obligatory xkcd

[realityimpaired]

People are under the mistaken impression that would-be hackers waste their time trying to brute force passwords. They don't. They either exploit design vulnerabilities (in which case your password doesn't matter), or they try a little social engineering to get your password. The one thing the movie Hackers got right was the scene when Dade called up the night security desk at one of the places he was trying to hack, pretending to be an employee in a panic, and got him to read the phone number off the modem so he could dial in. That's how it really does work... you come up with a ruse, and convince somebody who doesn't know better to give up sensitive information that you can use to gain access to the system.

And that's where passphrases have a huge advantage: they are easy enough to remember that they don't need to be written down.