Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.

Step 1: Choose an artist (a recording artist I presume)

Lets choose as an example case study the teen idol and all round bad boy Justin Bieber.*

Step 2: Choose a song. (The catcher the better)

Next, I need to choose a song from the Biebs vast repertoire of classics. My particular favourite of his, is his insightful look into the dark world of controlling relationships “Boyfriend”.

Step 3: Choose some lyrics

Now I need some lyrics from “Boyfriend”, I'll go with the slightly menacing chorus. “If I was your boyfriend, I'd never let you go

Step 4, 5 and 6: Passwordify the lyric

Now we need to take the Biebs prose and turn into a password. We do this by taking the first letter of each word in the lyric “If I was your boyfriend, I'd never let you go, I'd never let you go”

iiwybinlyg

Make it case sensitive:

iIwyBiNlYg

Turn it into 'leet speak' by changing it up with symbols and numbers:

1Iwy&1NlY9

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method.

As we are all aware, humans can be very predictable creatures, it wouldn't take a huge amount of effort to generate dictionaries based on certain demographics, music genres, or targeted attacks based on profiling individuals.

My initial thoughts on this was that this would be terrible advice to give out in a business as it would lead to many users using the same formula to develop their passwords, which would only be exacerbated by making the passwords more predictable. On a national scale this could be sound advice, which leads me to my question:

Is the BBC’s advice on how to choose a password sensible, given how predictable we humans are? If so, in what scenarios is this sensible advice?

*Justin Bieber used for humorous reasons only.

share|improve this question
27  
Have you seen that your password contains 3 times the letter "i" (even if in different forms)? I could bet that, depending on the language, there are letters you will most likely find at the beginning of the words than other, thus greatly reducing your final password entropy. – WhiteWinterWolf Jan 20 at 16:34
301  
First of all you didn't follow their advice - they specifically said a musical artist, of which Bieber is neither. – AviD Jan 20 at 17:27
20  
Bottom line and in short - very bad advice. – AviD Jan 20 at 17:29
14  
It's good advice if it makes your password generating scheme more secure than it currently is. It's bad advice if it makes your password generating scheme less secure it currently is. I'm pretty sure using the Correct Horse Battery Staple method is more secure, easier to remember and there are already plenty of sites that will help you generate a random one. – aslum Jan 20 at 21:39
27  
It's worth remembering that the article is written in the context of people using passwords like 'password' and '123456' and 'qwerty'. For those who frequent security.stackexchange.com, sure, this method is far from great. If it reduces the number of people using '123456', though, I'm all for it. – Chris Jan 21 at 8:59

16 Answers 16

up vote 146 down vote accepted

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method.

This is a good question, and I'm going to depart from the norm here, put on my tinfoil hat, and say "no, this is not a good idea." Why? Let's look at it in the context of the Snowden leaks.

Because the GCHQ spies on all traffic on the British internet, and according to the Snowden leaks, your internet traffic is shared with the five eyes. Even if you're using HTTPS, this is a bad idea.

"But Mark Buffalo, you're being a maniac tinfoil hattist again!" Think about it. The time to crack your password was suddenly and significantly reduced. How?

  1. GCHQ takes history of your online searches. They likely know when you signed up for a certain website thanks to XKeyscore.
  2. If they know when you signed up for that website, they'll see you went to Google.com around that time and did a search for song lyrics. Even if you're using HTTPS, the fact that you connected to google.com around that time, and then visited a website that hosts song lyrics, is all they need to begin breaking your password.

    • Even if they can't view the traffic, they can still see that you connected. Even if you're using HTTPS, this doesn't stop them from hosting lyric websites themselves. This also doesn't stop companies from logging your search results, and it doesn't stop the companies from providing these results to anyone. If they know what kind of songs you like, or don't like, it makes it even easier.
  3. Now they can write an algorithm to crack your passwords much, much easier than brute-forcing every possible combination. Or even better yet, use a ready-made password cracker with a provided dictionary of those results.


But Mark Buffalo, the government isn't monitoring me!

That's all fine and dandy. You generally don't need to worry about them unless you're a criminal. Or you're privacy-conscious. Or you're a security researcher.

There's another important aspect you need to consider, which I think is far worse than the government: advertisement companies, and hackers "But Mark Buffalo, I use NoScript (great) and Ghostery (Ghostery sells your info)!" Most people don't use those. And many people who do, also don't use those tools when they use their smartphone.

There are data trails everywhere, especially if you own a smartphone (android in particular), and there are plenty of evil marketing companies that will sell your data down the river the first chance they get. Or maybe they aren't evil companies, but they get breached by hackers.

Anyone with a "need" could buy that data, and those sophiscated enough could steal it. While this seems like frantic worrying for such a small thing for most people, it gets much worse when you delve into the realm of federal contracting. This is one of the ways security breaches start.

All of the steps listed previously could be done without XKeyscore. They can be done very easily with vast marketing databases.


Stop the tinfoil, Mark.

If I were wearing my tinfoil hat right now, I'd believe this article was made as part of a plan to intentionally weaken standards. I personally believe that weakening standards is a national security risk, especially when federal contractors adopt those weakened standards.

Personally, I would worry more about evil marketing companies and hackers than I would the government. Especially when deliberately-weakened standards are what help potentially-hostile countries gain unauthorized access to critical infrastructure and intellectual property.


But seriously, this makes your password weaker

Now let's talk about numbers, and social engineering.

With a normal brute force of this password, you'd likely need the following characters based on this password policy:

  abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=

That's 76 possible characters. With this password method, assuming most people will use 6-7 words to generate the password, and perhaps add 1 symbol - !@#$%^&*() being the most common - plus a number, you'll need to test - for an 8-character password - 1,127,875,251,287,708 combinations to exhaust the password space. This could take an impossibly long time depending on the hashing algorithm and hardware.

Let's use md5 as an example (it's terrible, but it's computationally cheap. Please don't use md5; I am only using it as an example). To exhaust the character space of an 8 character password, it would take 4 years to crack with a cheap workstation. About 4 years 25 days 7 hours 46 minutes 54 seconds. If you were to up the password length to 9, it would take over 309 years. Keep in mind that processing power is growing rapidly.

Learning extra parameters about the user's password allows you to simplify this. Let's assume that you choose the following song: baby hit me one more time. This is your favorite song, and I know this because I socially-engineered you into telling me. Let's choose a predictable lyric phrase to create a password with: Hit me baby one more time. This becomes HmBomT. Now let's add some leet with a number. Now we have H@BomT3. Now that we know your favorite song, and your favorite phrase, this is what your password alphabet space becomes:

hHmMbBoOmMtT1234567890!@#$%^&*()-_+=

As you can see, this alphabet space is significantly reduced. It's much, much faster if you know what character the password starts with, but let's assume you don't. Let's further assume it's been randomized. Now you've reduced the time needed to exhaust the password space to 2,901,713,047,668 combinations, it takes 3 days to crack the password with a cheap workstation. Let's upgrade it to 9 characters. Now it takes 137 days 15 hours 47 minutes.

You can calculate this yourself (charset: custom). Also, all of this assumes you don't have a dedicated GPU cluster.

EDIT:

It's come to my attention that there is now evidence of custom hardware solutions dedicated to cracking bcrypt, one of which is a lot less expensive than a 25-GPU array, uses less power, and is vastly superior in every regard. Please read this amazing article if you want to learn more.


But shouldn't we simply increase password length?

Yeah, you could. Truthfully, it greatly increases entropy when you increase the password length.

However, then it becomes annoying to enter - especially for corporate environments that require you to log out every time you leave the computer. On top of that, it's very hard to remember this password.

You might eventually forget it after entering different passwords and being forced to change every few months. Even worse, you could forget it immediately, and be forced to visit the IT help desk to reset your password. This results in costs to the business, and lost productivity.

In fact, a better method would be a xkcd's correct horse battery staple. You could use an upper case somewhere, and a number somewhere else, or you could make it even easier while increasing entropy: something like correct horse battery staple gasoline. It's very easy to remember, very easy to type, and it's very hard for computers to break. Also remember that this should be randomly-generated from a 2048 word list.

For websites, I would recommend a password manager such as KeePass. I would not use LastPass, as it's vulnerable to phishing attacks. Websites can know you have LastPass enabled, because your browser is sending this information to the website if requested! This is part of how browser-fingerprinting works.

For corporate and other logins which you aren't able to use a password manager with, I would recommend a variant of correct horse battery staple with an extra word. Maybe correct horse battery staple gasoline? Much easier to remember.

share|improve this answer
13  
Whether or not this makes your password weaker depends entirely on who is reading the article. If you are the type of person who would read this advice and then pick the chorus of your favorite song as the password, you are the type of person whose password without this advice is either "password" or their birthday. In which case, hmbomt is far far stronger. – Shane Jan 21 at 16:46
6  
@Shane - I have to disagree with this statement. Worse than no security measures are insufficient security measures that you trust. – Mauser Jan 21 at 18:03
4  
@Mauser No security vs weak yet trusted security is not the dichotomy at play here. Do you think people are using passwords that they KNOW are bad? No. If they are using their birthday as a password, they trust it as a good password. The dichotomy at play here is extremely weak trusted security vs weak trusted security. – Shane Jan 21 at 18:13
20  
@ToddWilcox, if you think "I love Stack Exchange!" is an example of the XKCD method, then you don't understand the XCKD method at all. It's supposed to be 4 or more randomly chosen words. – Ben Jan 22 at 4:57
9  
@Fax on the other hand, if somebody doesn't care because "making a secure password is too difficult", stumbles upon this article while checking the news and thinks "OK, I can do that" then a few passwords get a tiny bit better. jb4uiwhd4eva is much better than 123456, even if it's not as good as C9Tds=mTrB&VL$SbRwW2gd!FKhW7q!JpMkCQ. "Don't let perfect be the enemy of good". – Blowski Jan 22 at 14:18

It's horrible :) To provide some numbers to back claims by other answers:

This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits per year! Average word count for a song is 300-600, depending on the style, and they do 7-10 words per sentence (And I imagine that's the comfortable length of a password nowadays).

All this tallied up - the corpus of password bases for people who listen to popular music will be about 40,000 per year, not including repetitions (And we all know popular songs don't have a single repeating line!).

As such, just picking a random common, everyday word and adding your favorite digit to the end is just as secure a password base (assuming your favorite song is less than a year old - very true for so many people!). Which, if you ask any IT or security personel, is not secure at all. In fact, it's strictly worse than XKCD's famous tr0ub4dor&3, due to a smaller corpus and smaller average word length, and that was discussed en-masse.

To add insult to injury - none of the steps in the advice is any good really.

  • Most people tend to listen to the same music. Just go to a concert of a boy-band and look at the sheer size of the crowd (vs the number of words the singer is going to mutter).

  • I sincerely doubt most people will take the fiddly middle of a verse. I find it much more plausible that it's the catchy chorus that will be chosen (After all, you have to remember the line word-for-word, not just the general meaning or tempo!)

  • Taking the first letter of words is horrible. 7 letters cover 65% of the language that way. Of course this didn't analyze lyrics specifically, but I doubt it's better there1.

  • Case-sensitive is OK, but only if you make the uppercase positions truly random. Which you won't. It's too easy if the first one is capital. And you don't lump them together, nonono. And there has to be a decent number, but not too much, right?

  • l33t-ing a password is mostly meaningless. Of the most-common letters, only a couple can be replaced, and the replacement is known beforehand. And you won't properly randomize which characters get replaced and which - not.


1 Trying to make an argument, I actually calculated the Shannon entropy from the article above. Turned out it's ~4.075, vs 4.7 for a random letter distribution. This is not as bad as I expected, although it does mean that a 10-character password is 70 times easier to guess if it's made by first-lettering, rather than having random letters

share|improve this answer
5  
Rats, you basically beat me to my answer, with better sourced numbers. :-) I would also point out that this is not just a theoretical attack, but is actually being done, by pulling phrases from "news websites, multilingual forums, public IRC logs, Wikipedia, Pastebin, e-books, movie scripts, and song lyrics": arstechnica.com/security/2013/10/…. It doesn't specifically mention taking the first letter of each word, but I'm sure that's one of the mangling rules they'll try soon if they aren't already. – Ben Jan 21 at 4:22
    
And what if I use obscure, unpopular songs? – Zenadix Jan 21 at 14:46
1  
@Zenadix This was an assessment of the advice for the general public. Popular music wouldn't be "popular" if it weren't popular. Hence this is applicable for a large proportion of people. If you use obscure songs that only you and your friends know, then bullet point (1) is not applicable, all the other ones are however. But at that point, does it matter that it's from a song? – Ordous Jan 21 at 15:55
1  
@Casey Nope. The problem here is that it creates strong-looking passwords that aren't actually strong. If an attacker knows this to be a strategy (and yeah, it's now pretty wide-known), they can just scrape a lyrics website and try all of them. As Ben pointed out above, people used the entirety of Wikipedia for this purpose, it's not unimaginable that they use a lyrics database. I used popular music because it's easy to gauge and is applicable to most people (and gives horrifying results), but using obscure music will likely put you right on the boundary between "definitely bad" and "not sure" – Ordous Jan 26 at 15:05
1  
@Casey You're overestimating the natural language corpus. All of wikipedias in all languages contain ~23 billion words. Hence there are less sentences. Even if you pump that up significantly and say that rather there would be 23 billion distinct sentences, (i.e. ~2.3e+10), you can easily see the difference with a random 10-character password search space (70^10 ~2.8e+18). That's 100 million times less and is closer to a 5-6 char password. And that's a severe underestimation. Usually decreasing the entropy by a factor of 2 is called "critical security flaw", not "susceptible to brute-force" – Ordous Jan 26 at 15:17

It is more secure than what most people are doing, which is to use one dictionary words. The BBC's method starts with one or two sentence, instead of just a word. However, it is less secure than what it could have been.

First, if you're using a well known chorus, you're increasing the chance of other people having similar passwords to you.

Second, personally I think it's easier to type whole words than disconnected letters, even if it increases the number of keys that you need to press. Using just the first letters from a sentence throws away entropy.

My advice if you need a password that's intended to be remembered (i.e. can't be saved in a password manager) is to randomly generate a phrase using something like diceware.

Another alternative is to start by generating a random n-letters password. But then try to find a mnemonic for it. This difference in the order is crucial; if you start with the mnemonic and then passwordify the mnenomic, you're likely to be less random than if you generated the password first.

share|improve this answer
2  
+1 for random first and learn to memorise, it's much easier to figure out the entropy, and not so hard really. Probably less hard, and less risky, than picking some other scheme and (over-)analysing it. – Neil Slater Jan 20 at 23:00
5  
Its worse than "less secure than it could have been" its "instantly a worse idea upon publication by the bbc as will be part of standard cracker dictionaries immediately" – simbo1905 Jan 22 at 8:07

yes its not bad advice though it depends how strongly people follow it, unlike your self I wouldnt slam my favourite artist out there (we all know you like JB..)

following this advice would most likely make many pick their FAVOURITE artist and their FAVOURITE song and most likely the chorus or very well known line (the ones you sing along to and do not mumble) making it very easy to work out the average persons password, but, as it stands following this method would make it alot harder to guess but also alot harder to remember. creating good passwords and remembering them is a gift some people do not hold.

my counter advice would be randomly generate all of your passwords and store them in a keychain keeping only your primary email password and password to your keychain stored in your head.

but once again just so i do not seem so negative, this is a better option than ilovejb2016... its not bad advice for non-tech people.

I wanted to speak about this again, update my answer.

Im not saying its good for someone like us on this site who know security and are security conscious to follow this advice, this would most likely weaken our passwords following this method. BUT BUT BUT this advice would help people like my parents, my nan, kids. those who passwords might and most likely are terrible words following the standard one capitol letter at as their first character lower case and a number (most likely their age, birth year, 1, 11, 123, 321) and the password its self is a normal word relating to their everyday life. e.g. the name of their pet hippo.. Chubby123 for example!

THIS IS GOOD ADVICE FOR THOSE PEOPLE. but not us, you have to remember people, people are not very good with computers or being secure I could hack all of your grandmothers by writing common words.

share|improve this answer
6  
-1 for saying its not bad advice, but +1 for pointing out the resulting commonalities from a limited set of likely favorites, and preferring a password manager... – AviD Jan 20 at 17:30
4  
I am in agreement with @AviD. Sorry, but I disagree. I believe this is bad advice because it makes it much easier to crack passwords. – Mark Buffalo Jan 20 at 17:51
3  
I would agree with the point that people very, very frequently use worse strategies than this to select passwords. But I would disagree that that makes this strategy a "good" one. – halfinformed Jan 20 at 18:28
6  
I'm going to go against the consensus and disagree that it makes cracking passwords easier. "easier" is a relative term that implies that currently users are choosing good passwords and if they follow this scheme they'll be worse. That's objcectively not true, most users choose passwords which are much more predictable than the ones generated by this scheme. This scheme doesn't provide "good" passwords, but it may provide "better" passwords than the majority of users currently choose... – Rоry McCune Jan 21 at 9:10
1  
my point guys is not that its good advice but its better advice than the advice people already have. is better than putting down an obvious password .... this is easier to guess than l33tsp34k... if you get what I mean, it is not bad advice, though not good advice. – silverpenguin Jan 21 at 9:25

Like most things in security, it depends on what you're trying to protect, and who you're trying to protect it from.

Short answer is: For logging into most websites, it's likely secure for attackers trying to guess passwords by trying multiple logins.

For any scenario where an attacker can perform an offline attack this is unlikely to be a good method of preventing a determined attacker since offline attacks can perform millions, sometimes billions of attempts per second. This would be true for wifi passwords, encryption passphrases, or if an attacker obtains the hashes from a website.

share|improve this answer
    
A hacker can make billions of guesses no matter what kind of password you pick... the question, to my mind, is whether they are more likely to succeed if you create your password with this method than with a different one. – Casey Jan 26 at 15:00
    
@Casey The number of guesses per second in an offline attack depends on how difficult it is to hash the password. – Steve Sether Jan 26 at 15:16

In a world where people very frequently disclose information on social media about their favorite musical artists, songs, genres, and even specific favorite lyrics, is this a good password strategy to use?

Umm... no.

Will it withstand a simple guessing attack using, say, 500 very frequently-used passwords? Sure. (Unless the dictionary creator was wise to this tactic and you picked a really, really, really commonly-chosen lyric, I guess.) But if you were interested in stopping an attacker who was willing to do even very basic targeting recon/info-gathering about you--or already knew you to some degree (for eg., a co-worker)--this would be a lousy password choosing-strategy.

share|improve this answer

Passwords length is more important than complexity when it comes to security.

1Iw&iNLy3 so this password has 9 characters which is quite low and can be cracked in a matter of time.

So, when trying to increase the strength of your passwords/pass-phrases, my advice is to consider length as much or more than you consider complexity. Make your admin and root passwords/pass-phrase 18 or more characters long and forget about complexity at 18 characters-plus, they are all but uncrackable.

Please check yourself here the strength:

https://howsecureismypassword.net/

This password 1Iw&iNLy3 can be cracked in 275 days while this passphrase I_Like_Sausages_and_Eggs_For_Dinner will take 64 quattuordecillion years to crack.

So answering your question it is a very bad advice.

https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength

http://crambler.com/password-security-why-secure-passwords-need-length-over-complexity/ https://stormpath.com/blog/5-myths-password-security/

share|improve this answer
5  
"which is quite low and can be cracked in a matter of time." Everything is a matter of time. :P – Mark Buffalo Jan 20 at 17:54
4  
Can you trust using a site like howsecureismypassword.net? Couldn't they just be collecting passwords? – Almo Jan 20 at 18:18
6  
"Passwords length is more important than complexity when it comes to security." Not necessarily. The password iwillnevergohungryagain is much, much more likely to fall than 6J;snQv8e!fKn2a is, despite the former string being much longer than the latter. Because any decent guesser or cracker is going to try every dictionary of words/phrases/quotes/etc. they can think of before they will resort to plain brute-force character guessing. (At least where the attacker knows there's some kind of minimum-length policy in place to prohibit the most idiotically short passwords, anyways.) – halfinformed Jan 20 at 19:10
1  
@PyRulez You should edit your answer to specify that you are talking only about brute force then. – PwdRsch Jan 20 at 21:24
2  
@Almo But they say they don't. They wouldn't dare to lie on the Internets, would they? – Hagen von Eitzen Jan 21 at 22:19

To play devil's advocate, this technique can be used if you end up with a long enough password (you may want to use two lines for this). And it is definitely an improvement if your old password is harry1990 or qwerty123. However, this technique is (a) overly complex, and (b) the resulting password is sub-optimal. I believe this famous XKCD comic best explains what's wrong with complex convoluted rules which define your password: enter image description here

share|improve this answer
1  
This technique is just about as naive as the BBC one, unfortunately. It's only really 44 bits of entropy if your attacker is trying every possible combination of characters, and in the real world, they're using dictionary attacks. arstechnica.com/security/2013/03/… – Justin Lardinois Jan 22 at 23:28
2  
@JustinLardinois The 44 bits figure is right. See Diceware for one calculation. See the long argument at the xkcd forum for more. In the xkcd case, he assumed a dictionary of about 2000 common words, so it is a four digit number in base 2048, or 44 total bits. – RBerteig Jan 23 at 1:37
1  
Never mind then. That's what I get for not checking the math first. – Justin Lardinois Jan 23 at 1:38
1  
I'm kind of tired of seeing this comic, but I do like that every password leak you see scores of people using the exact password correct horse battery staple. – Casey Jan 26 at 15:01

Humans are indeed very predictable, a lot more so than we usually think we already are, see e.g. here. So, you should never choose your passwords using a scheme that involves meaningful information to you.

share|improve this answer
    
Of course that is better but then you can't remember it. – Casey Jan 26 at 15:02

Considering most people would likely pick a popular song's chorus (especially since you want 'the catchier the better') and only change letters like E and A to 3 and 4 respectively, it wouldn't be beyond the bounds of reason to generate a wordlist from popular songs in this manner with relative success.

share|improve this answer

The short answer is "no". This article by Jeff Atwood makes are fairly good case for any password of less than 12 characters being insecure.

Summary: the above is fine for the someone-trying-passwords scenario (~1000 guesses per second), but so would just using the phrase "If I was your boyfriend, I'd never let you go" as your password. Most people have so many passwords, at some point some some service they use will have all their password hashes dumped. This is the "offline" checking of hashes scenario. If the service uses an insecure hash, then your password doesn't matter. If they use a secure one, but someone thinks there's money in cracking the passwords, time on "cloud" machines with GPUs for fast hash calculations is cheap. This page puts the time to brute-force your example password at under 2 hours in such a scenario.

share|improve this answer

No. It isn't good advice on creating a password. I can't really see any specific advantage to the password method at all.

It's easier to guess because it likely uses a common phrase (remember, as criminals we're trying to crack as many passwords in the database as possible, not one specific one. Yes you might use an obscure phrase, but I'll bet the majority of people will use a chorus lyric from a popular song).

It's not secure to brute force attacks either. The length of password it produces is short, so you can brute force it relatively quickly. Maybe it would hold out against a brute force a bit longer than an equal length password without characters, as the criminals would likely run a brute force on just alphanumeric characters first.

It's also less secure because it's difficult to remember. If you can easily remember your password, you don't write it down on the post-it note under your desk or in the passwords.txt file on your desktop.

The only advantage this method has is resistance to dictionary attacks, as it contains no dictionary words.

As others have mentioned, the Correct Horse Battery Staple method is the best method for creating a memorable password that is resistant to pretty much every attack. There are currently 1,025,109 English words to choose from. 4 words gives 1.1^24 possibilities and 7 words gives you more combinations than the number of possible MD5 hashes. If you choose even a 4 word password and replace a random character with a random ascii character/symbol, you have essentially made dictionary attacks impossible and only brute force applicable. Assuming an average word length of 5 characters, the total number of combinations would be ~20^254, which is too big to compute even by Google's calculator.

However, if you can remember 4 words and a substitution, the password is incredibly easy for you to remember.

So basically, BBC's method is less secure than randomly generating a password. Don't use it.

share|improve this answer

Use a password manager.

A very popular password manager among the technocrati is KeePass.

My IT manager says "LastPass for the babies" (implying that its easiest).


edits: link removed due to objections to article's credibility. Direct answer added by request.

As for the question, I'll say it's good (but not great) advice. There's definitely worse passwords out there than 1Iw&iNLy3, and its more of a guideline than an algorithm: while you're using Justin Beiber, I could use quotes from the I Ching, Yogi Barra or Rocky IV, and my 'passwordification' can be more or less complex than yours. So their advice is a perfectly good starting point for folks who decline the use of a password manager.

share|improve this answer
3  
That article comes to the correct conclusion (use non-password authentication, or use a password manager and random passwords) but it gets everything else wrong. First of all, passwords created by the XKCD method ARE NOT CHOSEN BY THE USER. They are random. Why does everyone always think the comic is saying "pick 4 words off the top of your head"? It's recommending diceware. Secondly, bcrypt, scrypt, etc. are popularized primarily because they slow down dictionary attacks just as much as brute-force attacks, so that method also becomes untenable for good passwords. – Ben Jan 21 at 16:21
2  
Finally, big companies (Linkedin, Ashley Madison, patreon, Walgreens/CVS/etc., LastPass (ironically)) lose their password hashes frequently enough that I don't think it's fair to hand-wave away the threat of leaked password hashes. Especially for people who re-use passwords, that's at LEAST as much of a threat as online attacks. Although probably less of a threat than phishing. – Ben Jan 21 at 16:23
    
@Ben Good points. However, regarding "First of all, passwords created by the XKCD method ARE NOT CHOSEN BY THE USER", in many places, you can't use a password manager. In my opinion, the xkcd article is still somewhat good advice when choosing a password. – Mark Buffalo Jan 21 at 16:39
1  
Yes I agree the method is good, that was my point. The article claims the XKCD method is bad because the user is "not very creative" and may choose a password like "letmeinfacebook". – Ben Jan 21 at 16:55
    
I like password managers but they're not really practical for something you expect to need to log into often away from your own personal computer. – Casey Jan 26 at 15:03

In a word, no. It is extremely stupid. Anything that reduces the search space for attackers is insecure. Don't do this. Somebody should hold the BBC to account for this.

share|improve this answer

This is really bad advice I concur with the general consensus.

But, the target audience for this advice is people who use passwords like password123 or il0vecarr0ts so this will improve their passwords, albeit with a flawed password...but less flawed. Which is a good thing.

Also the risk of what you are protecting has to be considered, for example if a 14 year old girl is using a JB song to seed her password for Facebook, then that is probably a reasonable risk to take.

If however if someone like BA Obama is using all the single ladies by Beyonce to seed the password that protects the proverbial big red button on the US nuclear arsenal..well then that would be a little too risky.

share|improve this answer
    
There is no password on the big red button. Too risky. Nuclear arsenals don't fail-safe, they fail-deadly. – Alpha3031 Jan 24 at 1:12
1  
It'd be an improvement over 00000000 which was used for decades. – Casey Jan 26 at 15:07

Doing the math your password gets more secure (higher entropy) if its longer not more complex. Ideally it is long and complex but who can remember that. So there is always a trade-off between usability and security.

Here is are two good blog posts which discuss that in detail:

https://pthree.org/2011/03/07/strong-passwords-need-entropy/

http://crambler.com/password-security-why-secure-passwords-need-length-over-complexity/

share|improve this answer
4  
Pointing to blog posts rather than summarising the information is not very good practice for StackExchange, as blogs tend to disappear. Besides that detail, most people fail to understand the fact that entropy depends on the relative likelihood of a specific piece of information existing in-the-wild compared to others. Not all passwords are equal. Not all letters, symbols or additional characters add the same amount of entropy. And these blog posts you are pointing to contain wrong maths. – Steve DL Jan 21 at 16:56
    
Thank you Steve will keep it mind for the next answer. – Wolfram Kluge Jan 21 at 17:06

protected by Rory Alsop Jan 21 at 16:37

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.