5 ms·

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely

I agree with the point the author is making and generally am just as annoyed by arbitrary password rules; nevertheless: > chili dog monkey nutso Is definitely not 18 quintillion years at best it's approximately 250000^4 which is 2^72. A good (though still requiring some memorizing effort approach) would be something along the lines of https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi... which uses a standard dictionary of 1626 easily memorable english words with each password being a 12 word mnemonic phrase. 1626^12 ~= 12^128

mrob 11y ago
It's less than that because the words were clearly not picked randomly. "Chili dog" is an English phrase, and "monkey nutso" is a transformation of "monkey nut", also an English phrase.
petercooper 11y ago
it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that..
- forgotpwtomain 11y ago
  It's not quite like that - even if you don't try the more readily accessible combinations before the longer ones, but simply split your computational effort on each one in proportion (you'll find all of the 4 word ones have been tried when only 1/250000 of the 5 word ones have). Not to mention that "chili dog monkey" are not exactly rare words and even a 10k word english dictionary would contain those.
- paulmd 11y ago
  And the entropy of the password 0b0 is only a single bit - if the attacker knows you've used a single-bit password. Hashed into the SHA-256 space that's only a 1:2^256 chance of someone colliding with it. Still, is that a password you'd set? What does that have to do with the output of the password in terms of brute-force guessing? Aren't you kind of assuming that an opponent won't try a broad dictionary attack? Equal distribution of hash outputs fundamentally assumes equivalent distributions of hash inputs, and that's not true for the distributions of common passwords. Again - everyone knows the passphrase patterns everyone uses, everyone knows the password transformations everyone follows (eg l33t) and overall those patterns are significantly weak against attack because of this public knowledge. By those algorithm, with knowledge of salts/etc those passwords are very weak. Should you use a song, or a slight modification, or a l33t transformation? Certainly not - if the input space isn't uniformly distributed across the input space, the probability of hitting pay dirt definitely isn't uniformly distributed across the output space. Even the class of "valid transformations of sensical English sentences" is not an equal distribution because of the above. If you can compress a language you can attack it, because by the assumption of compression the data is not at its minimum entropy. Maybe not feasibly if you're lucky - but don't bet on it just because Webster's is big.
  - hueving 11y ago
    What are you going on about? Your giant post did nothing to refute the point that an attacker doesn't know you are using 1 word vs 4 words vs 12. Also, you seem to imply that there is a distinguishable difference in sha1 outputs of good random inputs and English word inputs, which violates a security property of cryptographic hashes. So there is a lot of fame to be had if you can prove that.
- TomGullen 11y ago
  Just cross reference with people who've posted that XKCD comic
nsmalch 11y ago
XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem https://en.wikipedia.org/wiki/Infinite_monkey_theorem
- DanBC 11y ago
  I'm not sure I understand how an infinite monkey attack would work against diceware. Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase. That's still 7776^7. Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attackable space.
  - nsmalch 11y ago
    As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messaging. Don't trust humans to do a machine's tasks.
    - DanBC 11y ago
      Humans use dice to generate randomness. They throw 5 dice, to get a five digit number. They look up that number on a list to get a word. They repeat this process until they have a 7 word phrase. So, there are weaknesses if humans roll the 5 dice and get 1, 1, 1, 1, 1 and then say "That's not random, I'll roll again"[1] or they roll a number, look it up and say "I'll never remember 'zerg', I'll roll again".
mrb 11y ago
It calculates 18 quintillion years because howsecureismypassword.net is simplistic and doesn't realize english words are being used. It categorizes each character into some categories (see https://howsecureismypassword.net/assets/js/app.min.js https://howsecureismypassword.net/assets/js/app.min.js): // Standard ASCII Characters add('ASCII Lowercase', /[a-z]/, 26); add('ASCII Uppercase', /[A-Z]/, 26); add('ASCII Numbers', /\d/, 10); add('ASCII Top Row Symbols', /[!@£#\$%\^&\*\-_=\+]/, 15); add('ASCII Other Symbols', /[\?\/\.>\,<`~\\|"';:\]\}\[\{\s]/, 19); [...] It sees the password is 22 characters long, and contains a-z chars (lowercase) and a space char (other symbols) so it estimates each char is drawn from a set of 26+19 = 45 letters. And it assumes the default bruteforcing speed is 4 billion passwords per second. So: 45**22/4e9/3600/24/365.25 = ~18 quintillion years.
ryan-c 11y ago
250,000^4 is obscenely generous. A typical person's vocabulary is maybe a tenth that, and people will be biased towards common words.

mrob 11y ago

It's less than that because the words were clearly not picked randomly. "Chili dog" is an English phrase, and "monkey nutso" is a transformation of "monkey nut", also an English phrase.

petercooper 11y ago

it's approximately 250000^4 If the attacker knows you've used four dictionary words in a row. Now you need to multiply the number by the odds of that..

forgotpwtomain 11y ago
It's not quite like that - even if you don't try the more readily accessible combinations before the longer ones, but simply split your computational effort on each one in proportion (you'll find all of the 4 word ones have been tried when only 1/250000 of the 5 word ones have). Not to mention that "chili dog monkey" are not exactly rare words and even a 10k word english dictionary would contain those.
paulmd 11y ago
And the entropy of the password 0b0 is only a single bit - if the attacker knows you've used a single-bit password. Hashed into the SHA-256 space that's only a 1:2^256 chance of someone colliding with it. Still, is that a password you'd set? What does that have to do with the output of the password in terms of brute-force guessing? Aren't you kind of assuming that an opponent won't try a broad dictionary attack? Equal distribution of hash outputs fundamentally assumes equivalent distributions of hash inputs, and that's not true for the distributions of common passwords. Again - everyone knows the passphrase patterns everyone uses, everyone knows the password transformations everyone follows (eg l33t) and overall those patterns are significantly weak against attack because of this public knowledge. By those algorithm, with knowledge of salts/etc those passwords are very weak. Should you use a song, or a slight modification, or a l33t transformation? Certainly not - if the input space isn't uniformly distributed across the input space, the probability of hitting pay dirt definitely isn't uniformly distributed across the output space. Even the class of "valid transformations of sensical English sentences" is not an equal distribution because of the above. If you can compress a language you can attack it, because by the assumption of compression the data is not at its minimum entropy. Maybe not feasibly if you're lucky - but don't bet on it just because Webster's is big.
- hueving 11y ago
  What are you going on about? Your giant post did nothing to refute the point that an attacker doesn't know you are using 1 word vs 4 words vs 12. Also, you seem to imply that there is a distinguishable difference in sha1 outputs of good random inputs and English word inputs, which violates a security property of cryptographic hashes. So there is a lot of fame to be had if you can prove that.
TomGullen 11y ago
Just cross reference with people who've posted that XKCD comic

nsmalch 11y ago

XKCD's diceware argument fails under certain conditions. Computationally very hard to crack, but when plucked from actual phrases that have been uttered; weak. So to give an example, any natural language phrase like: "I took a walk in a park" is easier to crack. I am certain there is somebody coding an infinite-monkey-type bruter to crack diceware as we speak: https://en.wikipedia.org/wiki/Infinite_monkey_theorem https://en.wikipedia.org/wiki/Infinite_monkey_theorem

DanBC 11y ago
I'm not sure I understand how an infinite monkey attack would work against diceware. Let's assume a word list of 7776 words. All words are lower case alpha. The attacker has pur wordlist. And the attacker knows there are seven words in the passphrase. That's still 7776^7. Even if we prune the wordlist ("I'm not using 'zerg' in my phrase", "I rolled 11111, that's not random so I'll roll again") it's still not an attackable space.
- nsmalch 11y ago
  As a rule of thumb, I would go after natural language phrases first, because it is impossible to tell if the phrase was machine-generated. It's nearly impossible to arrange dots randomly on a page with a pencil because there is always some structure or engrained rigidity in human guesswork. There is also the possibility that the dots were done by 'inception', and certain biases were programmed in via subliminal messaging. Don't trust humans to do a machine's tasks.
  - DanBC 11y ago
    Humans use dice to generate randomness. They throw 5 dice, to get a five digit number. They look up that number on a list to get a word. They repeat this process until they have a 7 word phrase. So, there are weaknesses if humans roll the 5 dice and get 1, 1, 1, 1, 1 and then say "That's not random, I'll roll again"[1] or they roll a number, look it up and say "I'll never remember 'zerg', I'll roll again".

mrb 11y ago

It calculates 18 quintillion years because howsecureismypassword.net is simplistic and doesn't realize english words are being used. It categorizes each character into some categories (see https://howsecureismypassword.net/assets/js/app.min.js https://howsecureismypassword.net/assets/js/app.min.js): // Standard ASCII Characters add('ASCII Lowercase', /[a-z]/, 26); add('ASCII Uppercase', /[A-Z]/, 26); add('ASCII Numbers', /\d/, 10); add('ASCII Top Row Symbols', /[!@£#\$%\^&\*\-_=\+]/, 15); add('ASCII Other Symbols', /[\?\/\.>\,<`~\\|"';:\]\}\[\{\s]/, 19); [...] It sees the password is 22 characters long, and contains a-z chars (lowercase) and a space char (other symbols) so it estimates each char is drawn from a set of 26+19 = 45 letters. And it assumes the default bruteforcing speed is 4 billion passwords per second. So: 45**22/4e9/3600/24/365.25 = ~18 quintillion years.

ryan-c 11y ago

250,000^4 is obscenely generous. A typical person's vocabulary is maybe a tenth that, and people will be biased towards common words.