undefined

points

[-]

The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw it into your cracking algorithm at virtually no cost.

If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variation.

by throwaway274481 hours ago|

parent|

[-]

I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically. What you describe as "bespoke" is likely the normal way someone might use it: with their chosen format.

For instance, I have multiple separator characters, multiple beginning and end characters, and numbers places at specific places, and arbitrary casing. That may be overkill but it's still essentially the xkcd format.

by applfanboysbgon1 hours ago|

parent|

[-]

> I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically

XKCD's youtube videos get millions of views each. It is a very popular comic, and that particular password advice has spread beyond it.

> What you describe as "bespoke" is likely the normal way someone might use it.

And yet the issue in question is about someone who refuses to adapt it.

by strbean1 hours ago|

parent|

[-]

The user in question might have their own personal format that doesn't meet the RustDesk constraints. E.g. they may not use capitals, but use `word1$word2&word3@word4`.

Tayloring your format to the requirements of each site is a step towards defeating the utility of the system; now the user needs to remember some arbitrary hard-to-remember details for each password.

Although having a standard format for your passphrases across sites removes some of the advantages over just using the exact xkdc format (when one of your passwords is compromised and attackers can guess your custom format elsewhere now)...

by throwaway274481 hours ago|

parent|

[-]

This is a non-issue with a password manager

by throwaway274481 hours ago|

parent|

prev|

[-]

> And yet the issue in question is about someone who refuses to adapt it.

Does this person exist?