Timeline for Is the NHS wrong about passwords?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 10, 2016 at 18:42 | comment | added | Ray | @LuisCasillas Hence the "or usually so" bit. A 2048 element vocabulary is (barely) enough to make the vocabulary size relevant. But merely going from a vocabulary of size 52 (in option B) to one of ~80 (in option C) isn't even close to the amount needed before the length ceases to be the dominant factor. My key point is "Always do the math when possible." In support of that, I pointed out the fact that the even the (overall quite good) xkcd advice has non-intuitive aspects. | |
| Oct 10, 2016 at 18:30 | comment | added | Luis Casillas | @Ray: Your observation that "correct horse battery staple" is a length-4 password from a large symbol set is spot on. But it undermines your earlier statement that the comic's point is (partially) that "length is king" (or usually so). | |
| Oct 10, 2016 at 16:19 | comment | added | Ray | @RobinWinslow It is pedantic, but really, it should be. The point the comic you embedded was making isn't just that length is king (which it usually is), but also that intuition can be misleading. Passwords that look good might not be and passwords that look easy to guess may in fact be quite secure. All rules of thumb break down at some point. (In fact, in the xkcd, "correct horse battery staple" is actually a length-4 password from a very large vocabulary.) The only foolproof way to determine password quality (or more precisely, password generation method quality) is to do the math. | |
| Oct 7, 2016 at 18:59 | history | edited | Luis Casillas | CC BY-SA 3.0 |
typo
|
| Oct 7, 2016 at 8:25 | comment | added | Anders | @RobinWinslow A six letter mixed case password is "better" than an seven letter lower case password. Just an example. | |
| Oct 7, 2016 at 7:02 | comment | added | Robin Winslow |
This is just so obviously wrong! To take even the worst case of your provided examples - 95^7 = 6.983373e+13, whereas 26^10 = 1.411671e+14. Even with a vastly larger character set (which is unlikely to actually be the case in practical terms), the greater length wins.
|
|
| Oct 6, 2016 at 22:38 | comment | added | Luis Casillas |
@RobinWinslow: But the NHS examples that you quoted show an apparent linear growth of password lengths (5, 6, 7, 10) vs. an exponential increase of alphabet size (26, 52, 95). So the rule of thumb that x^y grows faster on y than on x risks leading you astray on this one example. And again, just doing the math is simple enough that we don't need to resort to rules of thumb.
|
|
| Oct 6, 2016 at 21:56 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 47 characters in body
|
| Oct 6, 2016 at 21:46 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 18 characters in body
|
| Oct 6, 2016 at 21:08 | comment | added | Anders | There is nothing pedantic with this answer, and it does answer your question. If there is something else you want to know, I think you need to be more clear about it in your question. | |
| Oct 6, 2016 at 21:06 | comment | added | Robin Winslow | I knew you'd come back at me with an extremely cherry-picked case where power made less difference. Thanks for making your pedantic point. It's not useful, and doesn't answer the question. | |
| Oct 6, 2016 at 20:56 | history | edited | Luis Casillas | CC BY-SA 3.0 |
deleted 1 character in body
|
| Oct 6, 2016 at 20:55 | comment | added | Luis Casillas | @RobinWinslow: if we take 2^2 as the starting point, it is trivial to observe that 3^2 > 2^3. And my larger point is that there is no need to generalize when you have concrete examples that you can just calculate from. | |
| Oct 6, 2016 at 20:53 | comment | added | Luis Casillas | @RobinWinslow: My point is that unless we introduce randomness into the equation we don't really have any reason to believe either of these policies will actually be secure. Debating between those alternatives when humans choose the passwords is missing the forest for the trees. | |
| Oct 6, 2016 at 20:48 | history | edited | Luis Casillas | CC BY-SA 3.0 |
added 173 characters in body
|
| Oct 6, 2016 at 20:46 | comment | added | Robin Winslow |
Also, if any equation includes x to the power of y, it is pretty clear that increases in y will have a greater influence over the magnitude.
|
|
| Oct 6, 2016 at 20:44 | comment | added | Robin Winslow | This seems unnecessarily pedantic. I am aware that entropy is about randomness, but I'm asking which is a better policy. Are you really saying there is no point having any password policy at all apart from "use a random generator"? | |
| Oct 6, 2016 at 20:42 | history | answered | Luis Casillas | CC BY-SA 3.0 |