Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.

Modern password crackers combine different words from their dictionaries: [...]

This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.

The attacker will feed any personal information he has access to about the password creator into the password crackers. A good password cracker will test names and addresses from the address book, meaningful dates, and any other personal information it has. [...] if your program ever stored it in memory, this process will grab it.

His contention seems to be that because it's known that people might construct their passwords in such a way that it makes it amenable to attack, but it seems like the strength lies purely in the power of exponents. I assume he's alluding to people not choosing the words truly randomly, which perhaps isn't totally disingenuous, as I've rerolled a couple times to get something that isn't all adverbs and adjectives. However, I assume that lowering the entropy by a factor of 2-10 isn't really significant (if the word list is doubled to 4000, not that hard, the loss is more than recovered).

The other quip about "if your program ever stored it in memory" is a bit disconcerting though...aren't all passwords stored in memory at one time or another? That seems a bit overbroad; what is he actually referring to?

share|improve this question
A discussion with 123 comments about this is on reddit.com/r/technology/comments/1yxgqo/… –  Dick99999 Jul 10 at 7:20
On mouseover, the image title reveals - "To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize." This would help you :) –  Awal Garg Jul 10 at 14:35
This TED talk has some interesting research on different password creation schemes, including the xkcd one: ted.com/talks/… –  Leo Jul 10 at 17:52
Just for the record: If your password actually was correcthorsebatterystaple it now got a lot less secure! –  Dennis Jaheruddin Jul 11 at 17:10
If you do use a password like correcthorsebatterystaple, take care that you aren't logging into a system that silently truncates it! A password like correcth is probably easier to guess than N#y;f8eR. –  snailboat Jul 13 at 20:25

9 Answers 9

The Holy War

I think you will find that the correct way to generate passwords could start a holy war where each group thinks the other is making a very simple mathematical mistakes or missing the point. If you get 10 computer security professionals in a room and ask them how to come up with good passwords you will get 11 different answers.

The Misunderstanding

One of the many reasons there is no consistent advice about passwords is it all comes down to an issue of threat modeling. What exactly are you trying to defend against?

For example: are you trying to protect against an attacker who is specifically targeting you and knows your system for generating passwords? Or are you just one of millions of users in some leaked database? Are you defending against GPU based password cracking or just a weak web server? Are you on a host infected with malware[1]?

I think you should assume the attacker knows your exact method of generating passwords and is just targeting you.[2] The xkcd comic assumes in both examples that all the details of the generation are known.

The Math

The mathematics in the xkcd comic is correct, and it's not going to change.

For passwords I need to type and remember I use a python script that generates xkcd style passwords that are truly random. I have a dictionary of 2^11 (2048) common, easy to spell, English words. I could give the full source code and a copy of my list of words to an attacker, there are still going to be 2^44 possible passwords.

As the comic says:

1000 Guesses / Sec Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.

That strikes a nice balance between easy to remember and difficult to crack.

What if we tried more power?

Sure 2^44 is ok, but GPU cracking is fast, and it's only going to get faster. Hashcat could crack a weak hash[3] of that size in a number of days, not years. Also, I have hundreds of passwords to remember. Even xkcd style it gets hard after a few.

This is where password managers come in, I like KeePass but there are many others that are basically the same. Then you can generate just one longer xkcd pass-phrase that you can memorize (say 10 words). Then you create a unique 128-bit truly random password for each account (hex or base 64 are good). 128-bits is going to be strong enough for a long time. If you want to be paranoid go larger, it's no extra work to generate 256-bit of hex passwords.

[1] This is where the memory thing comes in, if you're on a compromised host you have lost. It doesn't matter if you type it or use a program like KeePass to copy and paste it if an attacker can key-log / read memory.

[2] Rather than the weaker (but more likely) assumption that the attacker has just torrented a dictionary called "Top Passw0rdz 4realz 111!".

[3] Sure we should all be using PBKDF2, etc... but lots of sites are still on SHA1. (and they are the good ones)

share|improve this answer
I thought that GPU cracking is not possible because of memory constraints of the GPU. So if the dictionary does not fit GPU memory, then the only other option is to make a list of all possible passphrases, which is not possible for 5 word phrases and up. –  Dick99999 Jul 10 at 7:43
@Dick99999 modern GPUs can have 6 GB of memory on a single card (although it would take 2 slots) and can easily store a dictionary of a few thousand words. –  Nate Kerkhofs Jul 10 at 9:07
@NateKerkhofs This is scary and amazing in same time. My first (programmable) machine had 1mhz and 64kb ram and you talk about 6GB video memory... –  PTwr Jul 10 at 13:11
"128-bit truly random password..." Truly random? Isn't it still pseudorandom? –  DLeh Jul 10 at 15:19
This should be the accepted answer if for no other reason than the Holy War part. –  Andrew Hoffman Jul 10 at 18:27

Schneier writes this:

This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.

but the key to understanding what he is really after is a little further in his essay:

There's still one scheme that works. Back in 2008, I described the "Schneier scheme"

so that's it. Ole' Bruce wants to assert that his scheme is the One and Only, the best, the winner, the ultimate scheme. Therefore, he needs to say disparaging things about the "competitors", regardless of whether such assertions are scientifically sound or not.

In this case, it has always been assumed that the password generation method is known to the attacker. That's the whole point of entropy computations; see the analysis. That attackers are "on to this trick" changes nothing at all (when an attacker knows the password generation method, the entropy computation describes exactly the password strength; when the attacker is incompetent and does not know the password generation method, the password strength is only higher, by an amount which is nigh impossible to quantify).

The quip about "passwords in memory" is just more incoherent ramblings. Passwords necessarily go to RAM at some point, whether you type them or copy-paste them from a password safe, or anything similar.

My guess is that Bruce was drunk.

share|improve this answer
Yeah, I thought his comments were an odd departure from his typical good advice. His recommended scheme probably isn't bad, but hasn't been subjected to much actual testing. The passphrase approach is fairly easy to test in comparison, and you'd think that would appeal to the cryptographer in him. Maybe he just skimmed over the news about cracking natural language passphrases and didn't see a distinction between those and random word passphrases. –  PwdRsch Jul 10 at 16:30
None of the 'remarkable' examples form Schneier show any trace from being randomly chosen words. Furthermore if these successful hacking exercises are given enough hash codes, they will find some phrases every week, nothing remarkable: it's in the math. Even if a 4 random word phrase requires 5 years of guessing on average, the chance that it will be recovered on day 1 is one out of 3650, see see also <a href="security.stackexchange.com/questions/60709/… plea for day 1</a>. –  Dick99999 Jul 10 at 19:13
Link to original Schneier post? –  Naftuli Tzvi Kay Jul 15 at 18:43
Your argument about him needing to denigrate the competition fails, since immediately after describing his scheme, he says "Even better is to use random unmemorable alphanumeric passwords (with symbols, if the site will allow them), and a password manager like Password Safe to create and store them". –  wfaulk Jul 16 at 15:16
@wfaulk Password Safe is Bruce Schneier's creation, so his argument about the competition still stands. Your fail statement fails ;-) –  AviD Jul 17 at 12:08

The XKCD password scheme is as good as it ever was. The security doesn't derive from it being unknown, but from it being a good way to generate memorable passwords from a large search space. If you select the words to use rather than generate them randomly, though, this advantage is lost -- humans aren't good at being random.

The bit about memory is poorly stated, but it is a concern: if password-stealing malware ever gets on your computer, it'll sweep up everything text-like from RAM and the hard drive to use in a directed attack on your accounts.

share|improve this answer
+1 I don't think the XKCD technique is dead - it's not 'a trick' that crackers 'are on to'. You can know the technique inside out but that doesn't make it any more crackable if it's random enough. –  Matt Lyons Jul 10 at 7:15
@PiTheNumber if you're using not enough words or a tiny dictionary, then you aren't applying the xkcd technique at all; but no, even in the xkcd comic it's explicitly clear that you are NOT losing your advantage if you tell everyone "hey, I'm using correcthorsebatterystaple style password" - the amount of veriations/entropy bits is higher than most normal passwords even if the method is known. –  Peteris Jul 10 at 10:06
Provided you don't also use XKCD's random number generator (I won't link, everyone knows it). –  Steve Jessop Jul 10 at 11:56
@PiTheNumber the concept of '11 letter truly random password' is irrelevant, as it is not a reasonable alternative to passphrases. Passphrases are alternative to memorizable passwords, and those are exactly as weak as xkcd describes. Sure, if you use a password stored in a password manager, then completely random passwords fit, but in that case it's essentially not 'your password' as in something that you would use or see, but rather an 'autogenerated random key token' similar to ssh keys. –  Peteris Jul 10 at 12:07
@PiTheNumber The words are not human-chosen, they are chosen randomly. The dictionary from which the words are chosen is itself human-chosen, but that is a different matter. There is no “most likely” — the math in the xkcd comic is correct. –  Gilles Jul 10 at 18:10

[Disclosure: I work for AgileBits, the makers of 1Password]

One of the reasons why I advocated an XKCD-like scheme (before it got called that) in Toward Better Master Passwords back in 2011 is precisely because its strength does not rely on the attacker knowing what scheme you used. If I may quote myself

The great thing about Diceware is that we know exactly how secure it is even assuming that the attacker knows the system used. The security comes from the genuine randomness of rolling the dice. Using four or five words should be sufficient against the plausible attacks over the next few years given observed speed of password crackers [against 1Password Master Password]

What the XKCD comic does not effectively communicate is that the selection of words must be (uniformly) random. If you ask humans to pick words at random, you get a heavy bias for concrete nouns. Such biases can and will be exploited.

How much strength you want

In a perfect world we would want to strength of our password to be as strong as the keys we are protecting with it. Say 128 bits. But despite these techniques, humans aren't going to achieve that. So let's look realistically at attacks and what we can have our puny little brains do.

With the original Diceware word list of 7776 entries, you get approximately 12.9 bits per word that you use. So if you want at least 64 bits for your password, then five words will do it.

Guessing passwords is slower than guessing keys

In this section I arrive at a very rough back of the envelope estimate that for a constant amount of dollars it is 2^13 times slower to test a password than it is to test an AES key.

Note that testing a password is a lot slower than testing a key. If the right sorts of password hashing schemes are used, it is possible to keep most attackers down to under 100000 guesses per second. So while we might never want to use 50 bit keys, using 50 bit passwords might still make sense.

If we aren't going to limit ourselves to rolling dice as in Arnold Reinhold's original Diceware scheme from 1995, then we can use a longer list of words. The Strong Password Generator in 1Password for Windows uses a list of 17679 English words between 4 and 8 letters inclusive (stripped of taboo words and words that involve an apostrophe or hyphens). This gives about 14 bits per word. So four of these gives you 56 bits, five gives you 70.

Again, you do need to pay attention to cracking speeds. Deep Crack back in 1997 was able to run 92 billion DES tests per second. Assuming that a high end specialized PC can perform one million guesses per second against a reasonably well hashed password could do 1 million guesses per second, then passwords today are about 16 bits harder to crack than DES keys were in 1997.

So let's look at this Stack Exchange estimate for a dual core 3.8Gz processor: 670 million keys per second. If we were to assume $5000 in hardware, we can easily exceed 10 billion keys per second. So at a similar hardware cost, key cracking is still more than 2^13 times faster than password cracking.

Revised password strength goals

Working on my estimate that it is 2^13 times more expensive to test a well-hashed password than it is to test an AES key, we should consider a reasonably well hashed password as being 13 bits stronger than its actual entropy with respect to cracking. If we want to achieve 90 bits of "effective strength" then 77 bits of password strength should do it. That is achieved with a six word Diceware password (77.5-bits) from the original list and 84.6 bits with six words drawn from a list of 17679 words.

I don't expect most people to use passwords that long. I expect people will use things that are 4 or 5 words long. but if you are genuinely worried about the NSA going after your passwords, then six words should be sufficient assuming that you use a decent password hashing scheme.

Very rough estimates only

I didn't spend a lot of time researching costs and benchmarks. There are lots of things in my estimates to quibble with. I attempted to be conservative (pessimistic about the scheme I'm advocating). I've been vague about "well-hashed passwords" as well. Again, I'm being very conservative with respect to the password hashing in 1Password. (For our new data format, attackers have been kept to under 20,000 guesses per second and for our older data format they've reached 300,000 guesses per second for multi-GPU machines. In my estimates here, I've picked 1 million guesses per second for a "reasonably well-hashed password".)

A few more historical notes

The overall idea for "XKCD-like" passwords goes at least as far back as the S/Key one time passwords from the early 1980s. These used a list of 2048 one through four letter words. A six word S/Key password got you 66 bits. I don't know if this idea of using randomly selected words from a list for a passphrase pre-dates S/Key.

In 1995, Arnold Reinhold proposed Diceware. I don't know whether he was aware of S/Key at the time. Diceware was proposed in the context of developing pass phrases for PGP. It was also before most computers had cryptographically appropriate random number generators. So it actually involves rolling dice. (Although I trust the CSPRNGs on the machines that I use, I still enjoy "rolling up a new password").

In June 2011, I revived interest in Diceware in Toward Better Master Passwords with some additional modification. This resulted in my 15 minutes of fame. After the XKCD comic came out, I produced a geek edition that walked through some of the math.

In July 2011, Randall Monroe had picked up on Diceware-like schemes and published his now famous comic. As I am not the inventor of the idea, I don't at all mind being upstaged by the comic. Indeed, as I said in my follow-up article

What took me nearly 2000 words to say in non-technical terms, Randall Monroe was able to sum up in a comic. This just shows the power of math ...

But there is one thing about how the comic has been interpreted that does worry me. It is clear to me and people who already understood the scheme that the words much be chosen through a reliably uniform random process. Picking words "at random" out of your head is not a reliably uniform process.

share|improve this answer
Great that you mention Diceware in a historic perspective and at the same time acknowledge the great marketing job XKCD did for passphrases. About your modified scheme, is anywhere explained why 3 or 2 letter words are not included in those word lists? see blog.agilebits.com/2013/04/16/… . Is it because the words like 'off' and 'line' could also be attacked by 1 word offline? See my comments on the post of Raestloz. The original Diceware list contains many 1, 2 and 3 letter words. –  Dick99999 Jul 11 at 9:09
Excellent question! My (possibly erroneous) thinking at the time was that I also wanted passphrases to be a minimum length. I wanted to make sure that if someone used a three word passphrase, it would exceed a minimum of 12 characters in length. I note that S/Key also allows 1, 2, and 3 letter words. –  Jeffrey Goldberg Jul 11 at 19:36
I quickly checked the word lists my SimThrow passphrase generator and tester uses. The original Diceware list has at least 1400 of these collisions like 'any' 'how' and 'anyhow'. That may degrade a 4 word sentence to 3 words, if no separator is used. It's a high collision number because that list includes all letters and 2 letter combinations. So it seems you made the right choice to not include 2 letter words. Diceware advises a minimum sentence length of 17. My generator estimates both the word and character based recovery times, to cope with sites that allow short passwords (20) only. –  Dick99999 Jul 12 at 7:07
I also checked the following wordlists. S/Key: > 93 collisions, expanded-dicelists US: > 190 and my Netherlands list: > 750. A way to handle this is to recommend including a separator character between the words of a phrase. –  Dick99999 Jul 14 at 10:44
Beware, rolling dice is not perfectly random. forbes.com/sites/davidewalt/2012/09/06/… And insidescience.org/blog/2012/09/12/… –  wberry Jul 23 at 14:57

As others have said, the attack Bruce Schneier describes is effective when the user chooses multiple words him/her-self, not using a tool. Schneier usually writes to a general public audience, which is unlikely to grasp the difference between self-chosen "random" words and program-chosen random words.

I'll add that even if you use a script or other tool to randomly choose words from a dictionary, you have to use the first sequence it gives you. If you decide, "I don't like that one," and run it again until you do like it, it is no longer a random passphrase, it is human-chosen.

Also, even if you use a script, and even if you don't damage the randomness by choosing your favorite of multiple sequences, there is still the possibility that an attacker could exploit your PRNG (pseudo-random number generator). If the attacker can learn when you created the password, and what PRNG you used, and maybe other information about your PRNG such as network traffic that was produced using your PRNG around the same time, that could reduce the effective entropy of your random passphrase.

Perhaps a bit esoteric, but if your PRNG is exploitable, the 2^44 figure will not be fully realized. (And if you assume "no one will try to exploit my PRNG", why do you care about using a truly secure passphrase?)

share|improve this answer
+1 Interesting angle. Exploiting the PRNG is obvious in the context of encryption keys - it's interesting that it seems to be virtually an afterthought here. I guess typical passwords are so bad that PRNGs feel secure by comparison. Presumably, if an attacker can steal a list of hashed passwords, finding the pwdChangedTime or equivalent would be trivial? Another reason to end the practice of password aging? –  imsotiredicantsleep Jul 10 at 21:34
Quick back of the envelope. If you update the password within a minute of generating it and the only source of entropy in your PRNG is the system time, you may be looking at cutting things down as far as 2^35 for nanosecond resolution. Sound reasonable? –  imsotiredicantsleep Jul 10 at 21:53
Suppose I reject a phrase because I don't like a word and do that 1000 times. Then I have reduced the dictionary by 1000 words. Is the choice from that reduced dictionary still random? If it still is, then a 4 word sentence from a thus reduced 7776 word Diceware dictionary still gives (7776-1000)^4 = 2.1E15/50.9 possibilities/entropy bits, down from 3.7E15/51.7 possibilities/entropy bits for the full dictionary. I am not able to judge the influence of the random generator. I use the one from www.random.org –  Dick99999 Jul 11 at 6:49
@imsotiredicantsleep I don't know that much about how PRNG attacks are done, but my sense is that they are most successful when analyzing how they are initialized. The Mersenne Twister has a period of 2^19937 - 1, so previous outputs don't help the attacker much. But if you know it was seeded with (for example) current timestamp, MAC address and CPU serial number, and you know what day a password was created, that might be a lot easier. –  wberry Jul 11 at 15:19
@Dick99999 I don't think it's really about the number of offered choices you exclude in choosing one password. It's about the pattern of what phrases you would exclude, if presented to you. An attacker might guess that the user will prefer shorter words, words easier to type on a QWERTY keyboard, and words with no capitals or punctuation; this strategy could greatly shrink the space of passphrases to explore. Basically, it's the same issue as just guessing favorite sports teams, birthdays and kids' names. –  wberry Jul 11 at 15:25

It depends. One thing you need to understand is that this is not security-by-obscurity: the entropy values used in the comic assume that the attacker already knows you're using this method. If the attacker doesn't know how you're generating the passphrase, then the entropy goes up massively.

The trick to the XKCD method is that you need to actually use a random number generator and a good word list: never pick the words yourself, not even "randomly" (in quotes because humans are actually really bad at picking things randomly, which is why you shouldn't do it). Diceware has tools to help you do this, and even takes the random element out of the computer's reach by using ordinary dice.

Against a broad-based attack -the sort of thing where an attacker got a list of passwords from a Website and doesn't know anything about whose passwords are in the list- this is as strong as it ever was. Just as you say, its strength comes from the power of exponents (and a good word list).

Schneier's attack can work, but only in an entirely different context. His attack assumes that you are being specifically targeted, by an attacker who already knows a great deal about you. This might not seem especially worrisome at first, because the stereotypical determined attacker is an intelligence agent behind a screen, and most of us don't have to worry so much about those: there are only so many of them, and each one can only afford to care about so many people. But it's actually more of a problem than it might first seem, thanks to the advent of sophisticated malware. A malware installation can afford to care about you even though the attacker does not, and so you still wind up facing an extremely determined attacker. Even more determined than a human could be, in fact, though far less creative.

Malware that compiles information on you will give words that seem important to you very high priority in the word list. It does this because most people pick the "random" words themselves, but in so doing, they actually bias quite strongly toward the words that are most important to them: it may still "feel" random, but some words are much more likely to come up than others. For that reason, giving these words high priority often results in relatively quick hits, and this is the "trick" that Schneier is talking about.

However, you can still thwart Schneier's attack by using real randomness. The catch is that this requires discipline: all decisions about what words to use in your passphrase (aside from choosing a good word list) must be taken completely out of your hands. This is where things like Diceware can help you.

share|improve this answer
Your first paragraph is almost completely wrong (which is a pity, because your answer is otherwise good). The fact that the attacker knows that you're using the xkcd method does not significantly reduce the entropy. What would reduce the entropy is if the attacker knew which words you would pick — which he won't, if you follow the xkcd method, because you are supposed to pick them at random (not mentally, but with a die or something similarly truly random). –  Gilles Jul 10 at 18:02
@Gilles: The reason that the entropy goes down if the attacker knows the method is that it changes the whole structure of the password. If you don't know the method, then "correct horse battery staple" looks like 216 symbols from a 2-symbol alphabet: in other words, 216 bits. If you know that it's four English words (and know XKCD's wordlist), then it looks like 4 symbols from a 2048-symbol alphabet. 2048^4 is big, but it's smaller than 2^216, which is how many bytes of entropy a truly random bit string of that length would have. But XKCD's claim already accounts for that: 2048^4 = 2^44. –  The Spooniest Jul 10 at 18:27
Assuming that attackers believe that passwords are bit strings that follow a uniform distribution is a totally unrealistic model of attackers. Knowing the method only accounts for a handful of bits of entropy. –  Gilles Jul 10 at 18:58
Why would you know the length of the password, but not the fact that English words are more likely than average to appear in passwords? Again, your attacker model is completely unrealistic. Attackers don't go “hey, I'll generate all possible 27-letter passwords”. They go more like “hey, I'll generate all possible passwords in decreasing order of likelihood”. –  Gilles Jul 10 at 19:51
@Giles Actually both the string and method are relevant. You claim The Spooniest's opening paragraph is wrong, while making an argument that seems to restate it. If you don't know how the password is generated the entropy does go up greatly - ~166 bits for 27 characters (upper, lower, digit, punctuation). What you are saying is that attackers can use knowledge of how passwords are generated to reduce this. Seems like you are arguing the same thing from opposite ends. Also, not knowing the length increases the entropy. –  imsotiredicantsleep Jul 10 at 20:06

The strength math is quite simple if word choice is at random: (number of words in dictionary)^(number of word in the sentence), assuming the attacker knows the number of in words. So a 5 word phrase using a known (by the attacker!) 7776 word Diceware dictionary: has 7776^5=2.8E19 or 64 bits of entropy.

There is one item that is not mentioned in the scheme: by adding just 1 (random) character at a random place in the whole phrase, the strength is up by about 10 bits, see Diceware, Optional stuff.

The above math also does not account for separator symbol between the words. That can add another 5 bits.

share|improve this answer
The point (or at least one of them) of the XKCD comic is that adding one random character at a random place increases the difficulty of memorizing the password more than it increases the difficulty of cracking it. –  Mark Jul 10 at 7:41
True for memorizing in general, not true for a master password of a vault, I think. I see 'easy to type' as the main advantage. I encounter more and more situations where password managers cannot fill in the password (apps, WifI guest network) and I have to type them. –  Dick99999 Jul 10 at 7:49
@Mark - the extra random (or just non-dictionary) characters could be the same across all your passwords meaning you won't forget it. You'll earn the extra bits of entropy at least until several other of your passwords are compromised at which point the password is still xkcd-strength... –  imsotiredicantsleep Jul 10 at 11:28
@imsotiredicantsleep - That is a very interesting suggestion. Always looked for a solution to make this strengthening technique more easy to use. It could be called security by obscurity because the attacker can benefit from the knowledge about the random character and the position. A slight trade off, I think between ease of use and secure. –  Dick99999 Jul 10 at 18:22
@Dick99999 absolutely, it's a trade off. But until the constant component is compromised it will defeat a naïve dictionary attack, and significantly slow a more sophisticated one. I don't agree that it's security by obscurity though, as I can tell you that I am using the technique without losing the entropy that the possible values give me. The main weakness is that once the constant part is known you have sacrificed password real-estate that could have been randomised. –  imsotiredicantsleep Jul 10 at 18:42

I'd also like to add a yes answer also, but for other reasons. It's not a good advice [in general] because of length constraints:

  • Sites like Skype, ING, eBay, and in my country Binckbank ans KPN limit passwords to 20 characters. (That bank limit is 15, but it used 2 factor authorization)
  • With an average length of 4.5 characters/word for a short 3000-8000 word dictionary, that allows for using 3-4 word phrases only.
  • When using large dictionaries the average may be 6-7: 3 words only
  • If the site insists on using a symbol and a number in the password, only 18 characters are available for the phrase.

Those lengths only protect against online attacks. For Off-line attacks is depends on the key derivation and hash function, iteration counts and cracking hardware used by the site of app, whether a 3-4 word phrase offers sufficient protection.

share|improve this answer
Sites that limit the length of passwords are often a great indicator that their password storage system is very insecure. Run away. All in all, password strength requirements tend to be more detriminal than helpful, IMO (both to security and memorability). –  Luaan Jul 10 at 13:33
Add Suntrust to the list of passwords limited to 15 characters. I wonder what is up with that industry.. –  Andrew Hoffman Jul 10 at 14:27
I can tell you what is up with that industry: during testing, someone somewhere some time ago screwed up something that caused long passwords to fail. Probably they made the database column too small. The bank decided it was cheaper to just limit the field. Other banks saw it and, knowing that banks make profitable decisions, copied it. Most users never complain about not being able to have a longer password, so it was never in their (apparent) financial interest to change. –  corsiKa Jul 10 at 15:02
On the flip side, it's significantly easier to type 'correcthorsebatterystaple' on a smartphone than keep toggling between lowercase, uppercase, numbers and punctuation. –  Dragon Jul 11 at 10:31
Microsoft accounts must not have more than 16 characters (they also impose a minimum of 8). –  Ángel Jul 13 at 20:49

No, I don't think so.

The actual advice in that xkcd comic are to use mnemonics that are easy for you to remember and generate password as long as you can remember them. Those are basic password advice anywhere, and will always stand true (even the quoted Schneier's method uses these two basic facts). Indeed, the comic makes use of common English words, but your implementation doesn't have to be, nor did the comic implies that you should.

Of course, the most secure passwords are totally random strings like how an MD5 string looks, and you probably can use a password manager to store all those passwords, but then what password are you going to use for that manager? ¯\ (ツ)

share|improve this answer
"Of course, the most secure passwords are totally random strings" NO, see for a comparison en.wikipedia.org/wiki/Password_strength#Random_passwords –  Dick99999 Jul 10 at 8:59
Wouldn't diceware also generate a bunch of words combined into one? Which is the one Schneider tried to crack? –  Raestloz Jul 10 at 9:16
No, that's not what the xkcd advises, I suggest you read it again - and the analysis in the relevant question here (linked above). –  AviD Jul 10 at 10:33
Your signature "¯\ (ツ) /¯" is an excellent password: short, easy to remember, really hard to break, hard to detect as a password on a log. –  daniel Azuelos Jul 10 at 21:56
@Raestloz A person speaking a language that doesn't use characters that lie in the ASCII range isn't going to use an ASCII password. Do you think all those people in Asian lands use two keyboards, one for everyday typing, and one for passwords? Unlike thirty-year-old operating systems, like DOS, all modern OS's handle Unicode and other character sets/pages just fine, and any website should support them (so long as the developer doesn't encode the form using a random charset each time, or let the browser choose). Passwords are just bits that mean something to humans. –  phyrfox Jul 11 at 13:27

protected by AviD Jul 10 at 9:19

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.