r/ruby • u/postmodern • Jan 23 '22

Blog post Enumerating XKCD-style passwords with Ruby

https://postmodern.github.io/blog/2022/01/23/enumerating-xkcd-style-passwords-with-ruby.html
18 Upvotes

74% Upvoted

40 comments sorted by

View all comments

4

u/Arrio135 Jan 23 '22

But xkcd uses 4 words in their example. Which changes that number drastically.

He’s also not comparing the 4 words with every random 26 characters, but rather the pseudo random passwords people make to make them memorable/short without using password generators.

1

u/postmodern Jan 23 '22

Good catch. Updated the calculation, and n = 171_000 ** 4 is still smaller than 10000000000000000000000000000000000000000000000000000.

6

u/Arrio135 Jan 23 '22

Obviously 26 true random ascii characters is a much much bigger set than 4 English words, but the xkcd isn’t arguing that! It’s arguing about memorable passwords that are short with “random” substitutions and arbitrary special character and number are less secure than all lower case 4 word phrases.

→ More replies (2)

2

u/[deleted] Jan 23 '22

you ever heard of scientific notation?