[blueblob]

I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th?

    echo "l($(wc -l /usr/share/dict/american-english|cut -d' ' -f1)^4)/l(2)"|bc -l

    67.44701327930010565796

So we get a better power of 2 and a more accurate estimate. Granted one could filter the word list down to words that people actually know (which exceptional people normally know about 75,000 but most people know only 50,000[1]).

    echo "l(75000^4)/l(2)"|bc -l

64.77841190063187168389

    echo "l(50000^4)/l(2)"|bc -l

62.43856189774724695805

So I guess it's still better but it seems like a pretty big oversimplification to assume a length of word (especially a uniform one) and it shouldn't be that much harder to calculate the actual value. Maybe I did something wrong, I don't know.

[1] http://news.bbc.co.uk/2/hi/uk_news/magazine/8013859.stm

[markhemmings]

True, account should be disabled after x number of bad guesses. But securing against a "brute force" attack for me is more a case of cracking hashes from a db dump. It's easy to churn though vast numbers of hashes in no time at all these days. Here things like hashing algorithm speed, number of iterations, unique salting and original password length all have a part to play.

[equivrel]

Online bruteforcing is not feasible except for extremely weak passwords or sites with security vulnerabilities. What is feasible is bruteforcing stolen password hashes (think Adobe leak) or say a hard drive encrypted with a memorable password, and this is where secure passphrases come into play.

[williamcotton]

Or better yet, deterministic public keys like is seen with bitcoin.

[maxerickson]

The comic uses 11 bits per 'common word' to get to 44 (there are 11 little boxes by each word in the comic).

Underestimating that value isn't a bad thing.