Hacker News new | past | comments | ask | show | jobs | submit login

Are you a password cracker? Do you have a password cracker database in front of you?

Forgive is a word. @ is a commonly used symbol h3r is her with vowel replaced with number (very very common).

Quit is a word Smoking is a word Ever is a word For replaced with number (also very common) @ common symbol

Tbh the best password he could have written would probably have been a sentence like

I really should forgive my ex wife who I broke up with on May 23rd @ 8pm!

https://xkcd.com/936/




> Are you a password cracker?

Is that a job title? I have cracked passwords before, yes.

> Do you have a password cracker database in front of you?

Yes? It isn't the English dictionary, it is a common password list assembled by someone else based on historical password leaks.

> Tbh the best password he could have written would probably have been a sentence like

As stated in the article, the complexity requirements didn't really allow sentences. And that is been my experience with a bunch of systems. They have artificial length limits (e.g. 20 characters) and require arbitrary types of characters.

Windows' default complexity requirements are a typical example of this kind of thinking. It should be calculated based on some kind of strength score, not on 1980s style character sets which actually reduce the scope of available passwords (e.g. if the first letter has to be a letter, you now know that it is one of 52 characters).


Recent research seems to show that xkcd suggestion is not as safe as one would think see (https://www.ted.com/talks/lorrie_faith_cranor_what_s_wrong_w...)


Alright then try words written in latin & random characters from different types of alphabets.

ѣд学한☏

Seems pretty secure, but it's not over 8 characters...

If UTF8 was better supported, you could do something like

phone, snowman, snowman, pile of poo, phone.

That's fairly easy to remember and next to impossible to guess.


Great, now how do I use that password to log onto a mobile site from my phone? None of those characters are on my phone keyboard. Am I supposed to save them in a text file? That doesn't seem very secure.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: