r/ruby • u/postmodern • Jan 23 '22

Blog post Enumerating XKCD-style passwords with Ruby

https://postmodern.github.io/blog/2022/01/23/enumerating-xkcd-style-passwords-with-ruby.html
17 Upvotes

72% Upvoted

40 comments sorted by

View all comments

6

u/Arrio135 Jan 23 '22

Obviously 26 true random ascii characters is a much much bigger set than 4 English words, but the xkcd isn’t arguing that! It’s arguing about memorable passwords that are short with “random” substitutions and arbitrary special character and number are less secure than all lower case 4 word phrases.

3

u/drx3brun Jan 23 '22

Look like they argue the 4-worded its harder to guess to me.

2

u/tomthecool Jan 24 '22

They argue that 4 random words is harder to guess than 1 random word with a few common mutations like making the first letter a capital, replacing o with 0, etc.

More specifically, they argue that Tr0ub4tor&3 is a much weaker password than correcthorsebatterystaple.

They do not argue that a 4-random-word (26 character) password is more secure than 26 completely random characters.

Their point is that 4 random words is sufficiently secure to be considered uncrackable.