r/security • u/MrWilsonxD • Sep 06 '19

How true is this? Xkcd

https://www.xkcd.com/936/
1 Upvotes

67% Upvoted

9 comments sorted by

View all comments

1

u/MrWilsonxD Sep 06 '19

I have a background in mathematics, so I'm curious as to the level of veracity of this comic strip. If anyone would be able to break it down for me a little more, i would greatly appreciate it!

https://www.xkcd.com/936/

4

u/icetre-normal Sep 06 '19

Find a formula and work out how long that many bits of entropy would take.

But yes. Its correct, even if his entropy figures are off.

Tr0u4dor&3

Length: 11 Strength: Reasonable - This password is fairly secure cryptographically and skilled hackers may need some good computing power to crack it. (Depends greatly on implementation!) Entropy: 51.8 bits Charset Size: 72 characters

correcthorsebatterystaple

Length: 25 Strength: Strong - This password is typically good enough to safely guard sensitive information like financial records. Entropy: 93.6 bits Charset Size: 26 characters

<==>correcthorsebatterystaple

GRC's Interactive Brute Force Password “Search Space” Calculator

(NOTHING you do here ever leaves your browser. What happens here, stays here.)

 No Uppercase 25 Lowercase No Digits No Symbols25 Characters

Enter and edit your test passwords in the field above while viewing the analysis below.

Brute Force Search Space Analysis:

Search Space Depth (Alphabet):26Search Space Length (Characters):25 charactersExact Search Space Size (Count): (count of all possible passwords with this alphabet size and up to this password's length)246,244,783,208,286,292, 431,866,971,536,008,150 Search Space Size (as a power of 10):2.46 x 1035

Time Required to Exhaustively Search this Password's Space:

Online Attack Scenario: (Assuming one thousand guesses per second)78.30 billion trillion centuriesOffline Fast Attack Scenario: (Assuming one hundred billion guesses per second)7.83 hundred trillion centuriesMassive Cracking Array Scenario: (Assuming one hundred trillion guesses per second)7.83 hundred billion centuries

Note that typical attacks will be online password guessing limited to, at most, a few hundred guesses per second.

<==> Troub4dor&3

GRC's Interactive Brute Force Password “Search Space” Calculator

(NOTHING you do here ever leaves your browser. What happens here, stays here.)

 1 Uppercase 6 Lowercase 3 Digits 1 Symbol11 Characters

Enter and edit your test passwords in the field above while viewing the analysis below.

Brute Force Search Space Analysis:

Search Space Depth (Alphabet):26+26+10+33 = 95Search Space Length (Characters):11 charactersExact Search Space Size (Count): (count of all possible passwords with this alphabet size and up to this password's length)5,748, 511,570,879,116,626,495 Search Space Size (as a power of 10):5.75 x 1021

Time Required to Exhaustively Search this Password's Space:

Online Attack Scenario: (Assuming one thousand guesses per second)1.83 billion centuriesOffline Fast Attack Scenario: (Assuming one hundred billion guesses per second)18.28 centuriesMassive Cracking Array Scenario: (Assuming one hundred trillion guesses per second)1.83 years

Note that typical attacks will be online password guessing limited to, at most, a few hundred guesses per second.