3 ms·
100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lower
by ddlatham 11y ago
100 times yes. The mere presence of a single character from a different class does not increase entropy. It means that most common passwords move from 8 lowercase letters to 6 lowercase letters plus 1 number plus 1 symbol, which is even easier to search.
If you have a sophisticated entropy estimation tool, or library, great. Another simple thing is using a min length, plus restrict from a dictionary of the million most leaked passwords to outlaw those (can hold it in a bloom filter if size is a concern).
- Retric 11y agoMust contain 2 of the following, (upper case letter), (lower case letter), (number), or (Symbol) is higher entropy than 8 lower case letters.
- sokoloff 11y agoMathematically, but not socially. It means that humans reduce the entropy across the board to (more than, IMO) compensate for the mathematical advantage.
- deleted 11y ago[deleted]
- Retric 11y agoDo you have any data on this? Last I check pick to was a slightly better option.
- sokoloff 11y agoI don't have any real data. I know my own behavior for "sites I don't care about" and every once in a while I'm exposed to someone else's password (when they tell me their password for a site they don't care about, or where I see a password in plaintext in our shared password manager). There's an awful lot of "capitalize the first letter" and "replace e by 3, a by 4, o by 0" and "sometimes append a bang". That results in meeting the password complexity rules without any additional entropy in the first 2 rules and 1 bit of entropy for the last rule.
- bradleyjg 11y agoA randomly selected member of the set of all of 8 character strings which contain at least 2 of [(upper case letter), (lower case letter), (number), or (Symbol)] has more entropy than the a randomly selected member of the set of 8 character strings which contain only lower case letters. However, all bets are off if the respective strings are no randomly selected. 'Passw0rd' is worse than 'xmliicou'.
- sfilipov 11y agoAdditionally, I thought that's what key stretching and PBKDF2 - to slow down brute force attacks.