These are 17 of the worst, most cringeworthy Google AI overview answers:
- Eating Boogers Boosts the Immune System?
- Use Your Name and Birthday for a Memorable Password
- Training Data is Fair Use
- Wrong Motherboard
- Which USB is Fastest?
- Home Remedies for Appendicitis
- Can I Use Gasoline in a Recipe?
- Glue Your Cheese to the Pizza
- How Many Rocks to Eat
- Health Benefits of Tobacco or Chewing Tobacco
- Benefits of Nuclear War, Human Sacrifice and Infanticide
- Pros and Cons of Smacking a Child
- Which Religion is More Violent?
- How Old is Gen D?
- Which Presidents Graduated from UW?
- How Many Muslim Presidents Has the U.S. Had?
- How to Type 500 WPM
Steps 2 and 3 of your method already make it way too hard to remember
Just pick like 6 random, unconnected, reasonably uncommon words and make that your entire password
Capitalize the first letter and stick a 1 at the end
The average English speaker has about 20k words in their active vocab, so if you run the numbers there’s more entropy in that than in your 11 character suggestion.
Alternatively use your method but deliberately misquote it slightly and then just keep it in its full form.
TL;DR: your statements are incorrect and you’re being assumptive.
Steps 2 and 3 of your method already make it way too hard to remember
Step 2 is “hard”? Seriously??? It boils down to “first letter of each word, as it’s written, plus punctuation”.
Regarding step 3, I’ll clarify further near the end.
Just pick like 6 random, unconnected, reasonably uncommon words and make that your entire password
That’s a variation of the “correct horse battery staple” method. It works with some caveats:
- Your method does not scale well at all. If you try to harden it further, by using more words, you hit Miller’s Law. My method however scales considerably better because there’s some underlying meaning (for you) on what you’re using to extend the password further.
- Even in English, a language that typically uses short words, your method requires ~30 characters per password. Larger and less dense passwords are actually an issue because some systems have a max password size, like Lemmy (60chars max). My method however uses less characters to output the same amount of entropy.
- The least common the word, the more useful for a password, and yet the harder to remember. With synonyms and near-synonyms making it even harder. Typically less common words are also longer, making #2 even more problematic.
The average English speaker has about 20k words in their active vocab, so if you run the numbers there’s more entropy in that than in your 11 character suggestion.
I’ll interpret your arbitrary/“random” restriction to English as being a poorly conveyed example. Regardless.
The suggestion is the procedure. The 11 characters password is not the suggestion, but an example, clearly tagged as such. You can easily apply this method to a longer string, and you’ll accordingly get a larger password with more entropy, it’s a no-brainer.
For further detail, here’s the actual maths.
- Your method: 20k states/word (as you specified English). log₂(20k) = 14.3 bits of entropy. For six words, as you suggested, 86 bits. The “capitalise the first” and “add 1 to the end” rules do nothing, since systematic changes don’t raise entropy.
- My method: at least 70 states/char (26 capital letters, 26 minuscule letters, 10 digits, ~8 punctuation marks); log₂(70)=6.1. Outputs the same entropy as yours after 14 chars or so.
Now, regarding step #3. It does increase a little the amount of entropy. But the main reason that it’s there is another - plenty systems refuse passwords that don’t contain numbers, and some even catch on your “add 1 to the end” trick.
EDIT: I did a major rewording of this comment, fixing the maths and reasoning. I’m also trying to be less verbose.
Step 2 is “hard”? Seriously???
I don’t know how you’re meant to remember that “Works” and “Mighty” are capitalized
In most other quotes, the only capitalization occurs once at the start, so it doesn’t add any meaningful entropy.
If you try to harden it further, by using more words
Yours doesn’t scale due to step 3.
On the other hand, much like battery staple, it’s pretty easy to make up a visual or story in your head to connect the words.
Also, why would you need to scale this past 6 words? At that point it’s already more likely that your password is compromised via a keylogger or similar than anything else.
Even in English, a language that typically uses short words, your method requires ~30 characters per password.
I’ll accept this as a downside of the method, but honestly a website that limits your password character length to under 30 is probably doing some other weird shit that isn’t good.
Also, the only time you should really be using this method is if for some reason you don’t want to use a password manager. Not many scenarios like that that also limit characters.
yet the harder to remember
I feel like the exact opposite is true? Pretty easy to remember “defenestrate”. Much easier than remembering which m turns into a 3 in your method.
The 11 characters password is not the suggestion, but an example,
I’m aware how examples work. It’s 11 characters long and already too hard to remember.
I don’t know how you’re meant to remember that “Works” and “Mighty” are capitalized
Refer to step 1, please: pick a quote that you know by heart. And you’re still confusing the example with what it exemplifies.
At this rate it’s rather clear that you’re unable to parse simple sentences, and can be safely ignored as noise.
Just sharing this link to another comment I made replying to you, since it addresses your calculations regarding entropy: https://ttrpg.network/comment/7142027
The dice method is great. https://www.eff.org/dice
With EFF proposing it (plus xkcd proposing something so extremely similar that they’re likely related), it’s actually worse. If passwords like this get common enough, all that crackers need to do is to bruteforce the words themselves, instead of individual characters.
The EFF list has 6⁵ = 7776 words. If you’re using six of them, you get (7776)⁶ = 2.2*10^23 different states, or 77.5 bits of entropy.
Sure, and that’s roughly the same amount of entropy as a 13 character randomly generated mixed case alphanumeric password. I’ve run into more password validation prohibiting a 13 character password for being too long than for being too short, and for end-user passwords I can’t recall an instance where 77.5 bits of entropy was insufficient.
But if you disagree - when do you think 77.5 bits of entropy is insufficient for an end-user? And what process for password generation can you name that has higher entropy and is still easily memorized by users?
