<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div style="-webkit-text-size-adjust: auto; ">Because its wrong. </div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; ">1. The premise is wrong. The idea is a human should be able to remember the password. I (and most people who will see the comic) have a lot of accounts. In my case I have over 100 different accounts. I can't remember that many unique 4 word permutations.</div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; ">2. It doesn't account for genuine need for password restrictions. Some banks for example require passwords to be all numerical because they are entered on the phone as well. </div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; ">3. The math is wrong. It measures entropy as if each letter was chosen independently. This is fineish if the scheme is unknown but a lot of people use this scheme now. Humans are bad at random, take the 10,000 most popular words and a significant number of passwords will be comprised entirely of words in that list. Since we know the scheme the most passwords will fit into a search space of 10000^4</div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; "><br></div><div style="-webkit-text-size-adjust: auto; ">See also:</div><div style="-webkit-text-size-adjust: auto; "> <span style="font-family: '.HelveticaNeueUI'; font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); -webkit-text-size-adjust: none; "><a href="http://www.troyhunt.com/2011/08/im-sorry-but-were-you-actually-trying.html">http://www.troyhunt.com/2011/08/im-sorry-but-were-you-actually-trying.html</a></span></div><div><span style="font-family: '.HelveticaNeueUI'; font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); "> <a href="http://pinetik.blogspot.com/2011/11/xkcd-936-password-strength-and-why-this.html">http://pinetik.blogspot.com/2011/11/xkcd-936-password-strength-and-why-this.html</a></span></div><div><span style="font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><font face=".HelveticaNeueUI"> </font></span><span style="font-family: '.HelveticaNeueUI'; font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.296875); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469); "><a href="http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/">http://arstechnica.com/security/2013/08/thereisnofatebutwhatwemake-turbo-charged-cracking-comes-to-long-passwords/</a></span></div><div><span style="font-size: 15px; line-height: 19px; white-space: nowrap; -webkit-tap-highlight-color: rgba(26, 26, 26, 0.292969); -webkit-composition-fill-color: rgba(175, 192, 227, 0.230469); -webkit-composition-frame-color: rgba(77, 128, 180, 0.230469);"><font face=".HelveticaNeueUI"><br></font></span><span style="-webkit-text-size-adjust: auto;">On Sep 5, 2013, at 4:09 AM, Marius Gedminas <<a href="mailto:marius@pov.lt">marius@pov.lt</a>> wrote:</span><br><br></div><blockquote type="cite" style="-webkit-text-size-adjust: auto; "><div><span>On Wed, Sep 04, 2013 at 04:38:32PM -0400, Donald Stufft wrote:</span><br><blockquote type="cite"><span>On Sep 4, 2013, at 3:20 PM, Dag Sverre Seljebotn <<a href="mailto:d.s.seljebotn@astro.uio.no">d.s.seljebotn@astro.uio.no</a>> wrote:</span><br></blockquote><blockquote type="cite"><blockquote type="cite"><span>On 09/04/2013 04:59 PM, Antoine Pitrou wrote:</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>Then please add helpful guidelines as to how people can choose a safe</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>and easy to remember password /or passphrase/. Most people aren't password</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><span>experts, and the current one-line message isn't useful.</span><br></blockquote></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span>A link here should do the trick (which succinctly sums up this entire thread):</span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span></span><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"><span><a href="https://xkcd.com/936/">https://xkcd.com/936/</a></span><br></blockquote></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>I hate that comic :|</span><br></blockquote><span></span><br><span>Why?</span><br><span></span><br><span>Marius Gedminas</span><br><span>-- </span><br><span>You can't have megalomania. *I* have megalomania.</span><br><span> -- Joe Bednorz</span><br></div></blockquote><blockquote type="cite" style="-webkit-text-size-adjust: auto; "><div><span>_______________________________________________</span><br><span>Distutils-SIG maillist - <a href="mailto:Distutils-SIG@python.org">Distutils-SIG@python.org</a></span><br><span><a href="https://mail.python.org/mailman/listinfo/distutils-sig">https://mail.python.org/mailman/listinfo/distutils-sig</a></span><br></div></blockquote></body></html>