4 ms·
> a) the attacker doesn't have your dictionary How many truly unique sources for dictionaries are there? My own password generator simply uses `/usr/share/dic
by creshal 11y ago
> a) the attacker doesn't have your dictionary
How many truly unique sources for dictionaries are there?
My own password generator simply uses `/usr/share/dict/words`, which is not that hard to guess (and documented in the generator's source code).[0]
Add to this that not all languages lend themselves to this algorithm – while my native language is German, you'd need a word stem dictionary, as opposed to a regular dictionary, for this, so I stick to English dictionaries.[1]
[0] I actually made it configurable, but lacking a better source, it'll probably remain at this default: https://github.com/creshal/yspave/blob/master/config.json.example#L25 https://github.com/creshal/yspave/blob/master/config.json.ex...
[1] cf. http://creshal.de/News/?id=59 http://creshal.de/News/?id=59 , where I rambled on it a bit more.
- omh 11y agoMy own password generator simply uses /usr/share/dict/words On my system /usr/share/dict/words has ~45k words. That's 15 bits of entropy per word, significantly more than XKCD (which assumes 11 bits). So I'd agree that there probably aren't many unique dictionaries. The strength of this password scheme is that it works even assuming the attacker knows your dictionary. In practice, I guess that an attacker will use a concatenation of all popular dictionaries. This will make things slightly harder for them (e.g. if they have 50k words vs the 30k in your dictionary) but not by a huge factor.
- creshal 11y ago> The strength of this password scheme is that it works even assuming the attacker knows your dictionary. Indeed. Arguing about whether or not your dictionary is "unique" enough is a red herring. Whatever generator you use should accounts for the dictionary's word entropy, not for the theoretical per-byte entropy.