Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Being difficult to pronounce for English-speakers doesn't make dictionary words secure!

Fortunately, the web page itself suggests as much, but it's worth reiterating. Don't use these amusing passwords, please!



Realistically, though, how many people do you think have compiled rainbow tables against a Welsh dictionary?


It only takes one, and the idea has been floating around twitter for quite a while, as the linked web page mentions.


Javanese then?


Probably more than zero, now ;)


What is wrong with this password, for example?

>RoliedigHembryonauCarmeliaid6

Seems pretty consistent with XKCD's comic on passwords.


If you're using something like "CorrectHorseBatteryStaple6" and consider it a secure password, I have some bad news for you.


I dunno, I just did some back-of-the-envelope calculations and it seems to be okay:

With 8 high-end GPUs, we see a Blowfish speed of about 100 kilohashes per second. [0]

We assume we're cracking bcrypt strength 10, so we divide this number by 64 (2^10 ÷ hashcat's 2^4), and get about 1500 bcrypt checks-per-second.

There are about 170,000 words in the OED, and we choose 4 at random to give us 170_000^4 = 8.3521 * 10^20.

We can divide by 1500, but that still seems like a lot of seconds. (like, 3.5 ages of the sun)

[0]: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...


Unless the hash is in a cookie or something I probably couldn't guess it either within the lifetime of the sun etc.


It's got 80-120 ish bits of entropy, why is it not secure?

(Assuming you're not referring to it literally being a well known password from a web comic.)


Not the parent poster, but prior objections I've seen are that people don't do a good job at picking random words and four words is too few.


I assumed they meant using a diceware-like system to choose instead of literally making up words


> I have some bad news for you

Can you expand on that?




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: