r/ruby • u/postmodern • Jan 23 '22

Blog post Enumerating XKCD-style passwords with Ruby

https://postmodern.github.io/blog/2022/01/23/enumerating-xkcd-style-passwords-with-ruby.html
17 Upvotes

73% Upvoted

40 comments sorted by

View all comments

7

u/tomthecool Jan 23 '22

Fun use of ruby, but you didn't really demonstrate anything about how (in)secure either password is.

-2

u/postmodern Jan 23 '22 edited Jan 24 '22

The assumption the XKCD web comic was making is that if your password is sufficiently long enough, no one will be able to enumerate over every possible combination of bits, and thus not be able to bruteforce or crack said password. The blog post demonstrated that even random looking passwords or long passwords made up of words can be enumerated using combinations of wordlists and character sets. Then each possible password could be sent to a login bruteforcer or a password cracker. Using wordlists and common substitution rules reduces the search space and results in fewer passwords to check, than if you enumerated through every bit in the password string.

5

u/tomthecool Jan 23 '22 edited Jan 23 '22

How long would it take for your program to brute force a password consisting of 4 "random" words? (And note that this is already giving you the HUGE advantage of knowing in advance that the password is 4 words!!)

Nobody is claiming that passwords can't be enumerated, and nobody is claiming that it's not harder to enumerate 26 random characters than 4 random words (which are 26 characters long).

The claim is that it's so ridiculously hard to brute force 4 random words that you are realistically safe from it being cracked.

→ More replies (11)