wtfe²日本語

xkcd #936

Password Strength

by Randall MunroePublished: License: CC BY-NC 2.5

Comic: Password Strength (xkcd #936). Transcript below.

Password Strength © Randall Munroe · xkcd · CC BY-NC 2.5

Hover textTo anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

Why it lands

The estimates assume the attacker knows how the password was built, which is the honest way to count. The strip is from 2011; in 2017 NIST's digital identity guidelines (SP 800-63B) stopped recommending composition rules and routine expiry, much in the spirit of the bottom line.

Transcript

  1. UNCOMMON (NON-GIBBERISH) BASE WORD
  2. ORDER UNKNOWN
  3. CAPS?
  4. COMMON SUBSTITUTIONS
  5. NUMERAL
  6. PUNCTUATION
  7. (YOU CAN ADD A FEW MORE BITS TO ACCOUNT FOR THE FACT THAT THIS IS ONLY ONE OF A FEW COMMON FORMATS.)
  8. ~28 BITS OF ENTROPY
  9. 2^28 = 3 DAYS AT 1000 GUESSES/SEC
  10. (PLAUSIBLE ATTACK ON A WEAK REMOTE WEB SERVICE. YES, CRACKING A STOLEN HASH IS FASTER, BUT IT'S NOT WHAT THE AVERAGE USER SHOULD WORRY ABOUT.)
  11. DIFFICULTY TO GUESS:
  12. EASY
  13. WAS IT TROMBONE? NO, TROUBADOR. AND ONE OF THE Os WAS A ZERO?
  14. AND THERE WAS SOME SYMBOL...
  15. DIFFICULTY TO REMEMBER:
  16. HARD
  17. FOUR RANDOM COMMON WORDS
  18. ~44 BITS OF ENTROPY
  19. 2^44 = 550 YEARS AT 1000 GUESSES/SEC
  20. DIFFICULTY TO GUESS:
  21. HARD
  22. THAT'S A BATTERY STAPLE.
  23. CORRECT!
  24. DIFFICULTY TO REMEMBER:
  25. YOU'VE ALREADY MEMORIZED IT
  26. THROUGH 20 YEARS OF EFFORT, WE'VE SUCCESSFULLY TRAINED EVERYONE TO USE PASSWORDS THAT ARE HARD FOR HUMANS TO REMEMBER, BUT EASY FOR COMPUTERS TO GUESS.

Credits

Original
Password Strength — Randall Munroe, xkcd

The English page shows the original image unmodified. The Japanese page shows an adaptation by wtfe²: the lettering was erased from the art and replaced with a Japanese translation. The adaptation is shared under the same license as the original.