> I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that ... I tho

> I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that ... I thought real words were really bad in a password. A comment by "Hat Monster" on Ars explains why passwords generated using Diceware are secure: If you know your target is using a Diceware password, that is, you know the format is "english word, english word, english word, english word" you'd think it could have little entropy. Assuming that all entropy is only in the password, and the attacker knows exactly how you generated it, using which word list, and how many words long it is, this means each word, generated by 6^5 combinations, has 12.9 bits of entropy. Six words is 77 bits. 2^77 is large enough that a brute force attack on it at 1 trillion guesses per second (Snowden) would still take 151 trillion seconds, or 2.7 million years.