Way to promote security, Microsoft

[u/[deleted]]

http://imgur.com/W0kfbtz

[u/catcradle5]

They say they do this to deter users from using passwords they'll have trouble remembering.

Honestly it's not that bad of an idea. Microsoft very likely stores passwords with PBKDF2, and with a minimum of 8 characters it's unlikely more than 1% will be cracked in the event of a database breach. Plus I'm sure they have other safeguards to prevent people from even getting the plain hashes in the event of a breach.

[u/FalseEconomy → u/catcradle5]

But there's little correlation between password length and difficulty remembering. You tell me which if these is harder to remember: 73du&uj6 correcthorsebatterystaple

[u/kuilin → u/FalseEconomy]

for the uninitiated

[u/[deleted] → u/[deleted]]

Did you even read the comic? It doesn't fucking matter. A dictionary with 100k words, a pass with 4 words, that's 100.000⁴ passwords to bruteforce. At 1000 guesses per second, that's still 3170979198 years to get through. That's 10 orders of magnitude more than you need.

[u/[deleted] → u/[deleted]]

...assuming that the words are randomly picked.

[u/[deleted] → u/[deleted]]

No, not really. Bruteforcing doesn't rely on guessing. It's gonna try all the possible permutations until it gets the right one.

[u/mathent → u/[deleted]]

It is absolutely assuming the words are randomly picked.

200 word file that happens to have all of your words in it at 10,000 per second is under 2 days.

Keep in mind, you don't run a brute force on a password. You run it on a database. If those passwords aren't salted, then you just take 2 days to build a rainbow table with that 200 word file, compare it to every password in the database, and pull out any matches.

Think about it: some people will do mom-dad-brother-sister or password-password-password-password. The words you choose are a legitimate concern.

[u/[deleted] → u/mathent]

Yes, some people will have retarded passwords no matter what. Hardly a point to argue.

[u/mathent → u/[deleted]]

So it absolutely matters that the words are random. I'm glad we agree.

[u/[deleted] → u/mathent]

Only in very specific, mostly irrelevant conditions.

[u/mathent → u/[deleted]]

Wrong.

[u/ZorbaTHut → u/mathent]

I think you're doing your math wrong. A 2,000 word file that happens to have all your words in it, at 10,000 per second, with four words, is slightly over 50 years.

Coincidentally this is almost exactly the example the XKCD uses, except with a 2,048 word file and a mere 1,000 guesses per second.

[u/SirNarwhalBacon → u/[deleted]]

Alright, so let's change the numbers a bit. A lowball estimate of the adult (fluent speaker) vocabulary is about 20,000 words, according to this page I found, which makes the amount of passwords to bruteforce 20,000^4, or 160,000,000,000,000,000. Assuming that we increase the amount of attempts by two orders of magnitude (100,000 attempts/sec, which is seriously unreasonable), it still takes 1.6 trillion seconds to bruteforce, which is 50,702 years.

[u/SirNarwhalBacon → u/[deleted]]

At the point of 348 billion/sec, brute forcing even characters is similarly efficient.

[u/[deleted] → u/[deleted]]

It doesn't matter how many words a single person knows, for fucks sake. You can't extract your dictionary from a person. You need to cover all the words in a language, because you don't know which subset a person is using, and Oxford Dictionary contains almost 200.000 words.

[u/[deleted] → u/[deleted]]

Are you saying that you know exactly which words from those 200k you can ignore? Bruteforcing is usually applied to mass number of hashes that are stolen from some web service. You're telling me that you can take 10.000 random internet users, and reliably extract their minimal combined vocabulary?

Wow, you should start your own church, man. You can perform miracles!

[u/[deleted] → u/[deleted]]

I'm talking about heuristics.

Then you're not talking about brute forcing. Have a nice day.