0

This "correct horse battery staple" XKCD comic #936 was a topic discussed here already. However, I saw no one suggesting combining the second method of using dictionary words with an "injection" of extra non-alphabetic characters. Wouldn't that make it the best of both worlds without sacrificing the rememberability too much?

2
  • What do you mean by "an "injection" of extra non-alphabetic characters"? Because that's exactly what the comic is suggesting is not helpful.
    – schroeder
    Jan 7 at 0:14
  • 1
    I gave this exact advice in 2016 and still stand by it today.
    – Adam Katz
    Jan 8 at 21:01

2 Answers 2

4

The problem with your suggestion is that you're facing a dilemma: If you only add a few non-alphanumeric characters or make some trivial substitutions that you can easily remember (e.g., replace "o" with "0"), then the additional entropy you gain is minimal. If you make a lot of non-trivial modifications to the dictionary scheme, then the password will indeed be stronger, but it's no longer easy to remember -- which defeats the whole purpose of the scheme.

A better approach would be to use the dictionary scheme with more words. Or use a password manager and generate purely random passwords, if that's an option.

0

Stupid password rules can prevent a good password with lots of words because the character set isn't rich enough.

A compromise that satisfies the stupid rules without weakening the password or making it hard to remember would be to inject one or two each of numbers, symbols, capital letters... You could append these to the end, replace spaces, or append/prepend them.

Of course, doing this adds very limited entropy to an already high entropy password, but it satisfies the stupid rules, and if you make a minimal number of injections, shouldn't be too hard to remember.

Or you could just use a password manager. Storing a pass phrase with a moderate number of injected alterations is still higher security and more typeable (when the manager can't be used to copy/paste) than a fully random shorter password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .