Could someone explain today's XKCD to me?

[Apple Of Sodom]

Passphrases can be just as vulnerable as short passwords if it contains common words, and especially if it is a common phrase.

Passphrases are yet another compromise. It isn't very hard to come up with a difficult base password and then salt it with additional information for each new entry of it.

For example, let's say my name is Dave Smith and I was born in 1980. Picking Dsmith_1980 would be an okay password in itself for most applications (maybe not your day trading account)...but you don't want to reuse it for every site. So we come up with a schema that is easy to remember and add that to the password for every location.

For example, for websites we add the website name to the end of the password and then an exclamation point. You do this enough times it becomes easy.

Amazon password becomes Dsmith_1980amazon!
eBay password becomes Dsmith_1980ebay!

Maybe for work or other locations we use a simple identifier, such as work:
Dsmith_1980work!
Dsmith_1980home!

The one issue with this is if someone gets plain text of your password, then it would be easy enough to guess passwords for other sites. This is unlikely though.

For those with passwords that need changed often, it would be sufficient to keep the same base password and only change a portion of it.
Dsmith_1980work!1
Dsmith_1980work!2
etc.

Of course, there are sometimes security restrictions that will detect similar patterns in passwords, etc. You would have to learn how to use the system and adapt your schema.


The best thing for people to do is to come up with a schema that only they know and follow it for password creation. This way you don't really need to remember two dozen passwords - you only need to remember how you created it (such as remembering "it is my street address, question mark, then first four of website name, or whatever.)

I must reiterate that passphrases are problematic because you start doing a dictionary attack using words strung together. People also think long passwords don't need complexity, so they start using very long phrases that are somewhat common. thewinterofourdiscontent would be a terrible password, even though it is quite long.

 

[Fox5]

Passphrases can be just as vulnerable as short passwords if it contains common words, and especially if it is a common phrase.

Passphrases are yet another compromise. It isn't very hard to come up with a difficult base password and then salt it with additional information for each new entry of it.

For example, let's say my name is Dave Smith and I was born in 1980. Picking Dsmith_1980 would be an okay password in itself for most applications (maybe not your day trading account)...but you don't want to reuse it for every site. So we come up with a schema that is easy to remember and add that to the password for every location.

For example, for websites we add the website name to the end of the password and then an exclamation point. You do this enough times it becomes easy.

Amazon password becomes Dsmith_1980amazon!
eBay password becomes Dsmith_1980ebay!

Maybe for work or other locations we use a simple identifier, such as work:
Dsmith_1980work!
Dsmith_1980home!

The one issue with this is if someone gets plain text of your password, then it would be easy enough to guess passwords for other sites. This is unlikely though.

For those with passwords that need changed often, it would be sufficient to keep the same base password and only change a portion of it.
Dsmith_1980work!1
Dsmith_1980work!2
etc.

Of course, there are sometimes security restrictions that will detect similar patterns in passwords, etc. You would have to learn how to use the system and adapt your schema.


The best thing for people to do is to come up with a schema that only they know and follow it for password creation. This way you don't really need to remember two dozen passwords - you only need to remember how you created it (such as remembering "it is my street address, question mark, then first four of website name, or whatever.)

I must reiterate that passphrases are problematic because you start doing a dictionary attack using words strung together. People also think long passwords don't need complexity, so they start using very long phrases that are somewhat common. thewinterofourdiscontent would be a terrible password, even though it is quite long.

Why is it unlikely that someone gets the plain text? There's been several big hacks in the past few years where the website WAS storing the plain text. And don't underestimate malware and viruses, even a smart user can have their computer compromised by open security holes...Java has thousands of them discovered every year. (and after being compromised by a java applet exploit, I no longer install java on my computers)

 

[Apple Of Sodom]

Why is it unlikely that someone gets the plain text? There's been several big hacks in the past few years where the website WAS storing the plain text. And don't underestimate malware and viruses, even a smart user can have their computer compromised by open security holes...Java has thousands of them discovered every year. (and after being compromised by a java applet exploit, I no longer install java on my computers)

Storing plaintext passwords is bad practice and generally not done. You cannot mitigate every single risk that is out there.

Even if someone does get the plain text and can guess the schema, it is somewhat unlikely they will single out your password to make changes to. With thousands or millions of user accounts to try, what are the chances the thief will narrow in on your password and figure out the schema and make the changes (unless it is someone specifically targeting you?) Slim.

I would say it is perfectly fine for some resources and not others (who cares if someone hacks your news subscription account? But I would definitely care if it was my day trading account), or to come up with a schema that isn't so easy to guess.

Here is a base password: Dsmith_1980

Here is a password for amazon: AMDsmith_1980!N
Here is a password for eBay: EBDsmith_1980!Y
Here is a password for Paypal: PADsmith_1980@L

Easy schema to remember for most, but somewhat hard to guess in a silo. If someone said DAMsmith_1980!N is my Amazon password, could you possibly guess their CNN password?

For those who don't want to figure out schema, in this example I am adding the first 2 letters of the website before the base password, and if a vowel adding ! then last letter of website name, if consonant adding an @ then last letter.

Again, maybe not easy at first, but once you start doing it you can start making decent passwords and remembering them. Even if you forget the password, if you remember the schema you can remember it.

Yes, your password becomes predictable...so don't ever ever ever share your schema (even if you share a password it would take a shrewd individual to figure out your schema. They would need to suspect a pattern and figure it out.)