-----BEGIN PRIVATE KEY----- - eviltoast
    • cm0002@lemmy.world
      link
      fedilink
      arrow-up
      11
      ·
      4 months ago

      I would hope so, sentences and words are some of the most secure passwords/phrases you can use

      • bjorney@lemmy.ca
        link
        fedilink
        arrow-up
        4
        ·
        edit-2
        4 months ago

        Words are the least secure way to generate a password of a given length because you are limiting your character set to 26, and character N gives you information about the character at position N+1

        The most secure way to generate a password is to uniformly pick bytes from the entire character set using a suitable form of entropy

        Edit: for the dozens of people still feeling the need to reply to me: RSA keys are fixed length, and you don’t need to memorize them. Using a dictionary of words to create your own RSA key is intentionally kneecapping the security of the key.

          • bjorney@lemmy.ca
            link
            fedilink
            arrow-up
            0
            ·
            edit-2
            4 months ago
            1. we are talking about RSA keys - you don’t memorize your RSA keys

            2. if you rely on memorizing all your passwords, I assume that means you have ample password reuse, which is a million times worse than using a different less-secure password on every site

            • prole@lemmy.blahaj.zone
              link
              fedilink
              arrow-up
              1
              ·
              edit-2
              4 months ago

              Derp. Forgot where I was.

              I find passphrases easy to remember and I have several. I appreciate the concern, but I understand basic password safety.

        • shrugs@lemmy.world
          link
          fedilink
          arrow-up
          0
          arrow-down
          1
          ·
          edit-2
          4 months ago

          so you are saying 44 bits of entropy is not enough. the whole point of the comic is, that 4 words out of a list of 2000 is more secure then some shorter password with leetcode and a number and punctuation at the end. which feels rather intuitive given that 4 words are way easier to remember

      • ClamDrinker@lemmy.world
        link
        fedilink
        arrow-up
        3
        ·
        edit-2
        4 months ago

        While this comic is good for people that do the former or have very short passwords, it often misleads from the fact that humans simply shouldn’t try to remember more than one really good password (for a password manager) and apply proper supplementary techniques like 2FA. One fully random password of enough length will do better than both of these, and it’s not even close. It will take like a week or so of typing it to properly memorize it, but once you do, everything beyond that will all be fully random too, and will be remembered by the password manager.

      • Fillicia@sh.itjust.works
        link
        fedilink
        arrow-up
        0
        ·
        4 months ago

        The part where this falls flat is that using dictionary words is one of the first step in finding unsecured password. Starting with a character by character brute force might land you on a secure password eventually, but going by dictionary and common string is sure to land you on an unsecured password fast.

            • Zangoose@lemmy.world
              link
              fedilink
              arrow-up
              0
              ·
              4 months ago

              That’s true but in practice it wouldn’t take 60^11 tries to break the password. Troubador is not a random string and all of the substitutions are common ( o -> 0, a ->4, etc. ). You could crack this password a lot easier with a basic dictionary + substitution brute force method.

              I’m saying this because I had an assignment that showed this in an college cybersecurity class. Part of our lesson on password strength was doing a brute force attack on passwords like the one in the top of the xkcd meme to prove they aren’t secure. Any modern laptop with an i5 or higher can probably brute force this password using something like hashcat if you left it on overnight.

              Granted, I probably wouldn’t use the xkcd one either. I’d either want another word or two or maybe a number/symbol in between each word with alternating caps or something like that. Either way it wouldn’t be much harder to remember.

              • 14th_cylon@lemm.ee
                link
                fedilink
                arrow-up
                1
                ·
                4 months ago

                Troubador is not a random string

                except it is not troubador. it is troubador, ampersand, digit.

                if you know there are exactly two additional characters and you know they are at the end of the string, the first number is really slightly bigger (like 11 times)

                once the random appendix is 3 characters or more, the second number wins

                https://www.wolframalpha.com/input?i2d=true&i=Divide[Power[2048%2C4]%2CPower[256%2C3]*Power[2%2C4]*4*500000]

                and moral of the story is: don’t use xkcd comic, however funny it is, as your guidance to computer security. yes, the comic suggestions are better than having the password on a post-it on your monitor, but this is 21st century ffs, use password wallet.

        • shrugs@lemmy.world
          link
          fedilink
          arrow-up
          0
          arrow-down
          1
          ·
          4 months ago

          see, you didn’t get the whole comic. 4 words out of a dicitionary with 2000 words has more combinations then a single uncommon non gibberish baseword with numeral and puction at the end. as long as the attacker knows your method.

          a dicitonary attack will not lower the entropy of 44 bits, thats what the comic is trying to say

    • MehBlah@lemmy.world
      link
      fedilink
      arrow-up
      2
      ·
      4 months ago

      It the length not the content for the most part. Some keys have syntax such as leading or trailing characters.

  • wizzim@infosec.pub
    link
    fedilink
    arrow-up
    6
    ·
    4 months ago

    While the joke is funny, what is the context? Why did she post the original tweet in the first place?

    • MystikIncarnate@lemmy.ca
      link
      fedilink
      English
      arrow-up
      9
      ·
      4 months ago

      It’s lady gaga.

      If you’ve followed her at all, even indirectly, this is NOT the weirdest thing she’s done, and bluntly, the weirder stuff wasn’t justified (to the public at least).

      I’m not trying to throw shade at Gaga at all. Lady, let your freak flag fly all day long. You don’t need my permission to do it, but if you want it, you got it. Weird isn’t bad, it’s just weird.

      IMO, at this point, gaga doesn’t need a reason to be weird.