Pass PHRASES are much better anyway.
Nobody's gonna remember "pyf85ruGmmgæ&Oy_w48euaT0lt" so they'll either write it down, save it to their browser,or use a password manager, either of which makes it less secure.
On the other hand, something simple that doesn't necessarily make sense, say "AlmondsMakeFineGrenades" is difficult for both humans and machines to guess, but easy to remember.
Tl;Dr: an xkcd comic explaining it much better than I just did 😁
Using words in your password can undermine your security aswell, you need to include some other non-English stuff or you can be very vulnerable to dictionary attacks.
Using words in your password can undermine your security aswell
Only if they're predictable words and/or in a predictable order. No dictionary attack is going to guess the exact word combination above or equivalent any faster than the preceding keyboard mashing.
Unnecessarily adding complications only makes the pass phrase harder to remember and thus less effective.
I use a password manager for a few reasons, but not having to remember hundreds of passwords myself is definitely one of the main ones. I sometimes struggle to remember the few phrase-based passwords I do use.
Until you get hit with a dictionary attack.
Luckily this isn't really viable today as most logins just block you after like 5 attempts.
only sucks when you have 6 passwords and don't remember which oneUntil you get hit with a dictionary attack.
As I explained to the other one, no dictionary attack will happen upon that exact combination of words any faster than the keyboard mashing preceding it.
Using a COMMON word or a COMMON phrase would leave you vulnerable, sure, but no prediction process is going to happen on the exact combination.
Hell, add a word or two to "SaltyIceteaMaker" and it would make an extremely secure pass phrase. For something without that string in the user id, of course 😁
Use that, but only for the handful of passwords that you
a) need to remember regularly, even when you don't have access to your password manager b) need to be really secure
I'd say email and banking are the obvious ones. For everything else, rely on a good (self-managed, open source) password manager. Sure, a passphrase beats any human-memorable password, but it doesn't stand a chance against my 250bit entropy machine generated passwords. And thanks to KeepassXC I never have to type any of them. And sure, you can secure your password manager's database with a passphrase, if you're so inclined
Good, now hackers can prioritize English words in your passwords for bruteforce attacks!
hackers can prioritize English words
Yeah, all hundreds of thousands of them. In combinations that don't make logical sense. Do you have any idea how long that would take?
Even if I limited myself to a 5 word pass phrase from a word list of 5000, there would be 25989619781251000 possible combinations.
Make that list the entirety of the English language and there's no way you'd be able to brute force it before the sun becomes a red giant, let alone during the lifespan of an unhealthy elder millennial 😄
How do you find out the entropy of a string?
Put into your passwordmanager and look at its judgement. 13 characters with only lowercase letters + numbers is pretty bad honestly
Looks like the cat's seen some shit. Makes sense since they're in cybersecurity.
You gotta be careful with that sort of thing! Have people not seen Freakazoid?!
