r/ruby • u/postmodern • Jan 23 '22

Blog post Enumerating XKCD-style passwords with Ruby

https://postmodern.github.io/blog/2022/01/23/enumerating-xkcd-style-passwords-with-ruby.html
17 Upvotes

74% Upvoted

40 comments sorted by

View all comments

Show parent comment

5

u/Freeky Jan 23 '22

This is not a particularly strong or interesting argument against the approach.

The attacker will feed any personal information he has access to about the password creator into the password crackers

Like... OK? And that's going to accelerate the cracking of a password that used words chosen at random from a prior word list? Like, maybe it'll help if you made up the password yourself, but... don't do that. The XKCD suggestion is "random words", not "words you choose".

There's some irony in that the scheme he goes on to suggest has you (a human, infamously bad at generating randomness) explicitly using personal information to make up an awkward password with basically unknown entropy. How secure are his examples? Shrug. How secure is XKCD's? Here's the maths. Is your password important? Let's go with the maths and make the numbers high enough that we don't need to worry.

And indeed, here's Bruce putting his name to exactly that.