3 ms·

40,000 words gives 15.29 bits per word, for a 45.86 bit locator. log2(area of earth / 9m^2) is 45.7. Packing bits into phrases is also useful for passwords (ht

40,000 words gives 15.29 bits per word, for a 45.86 bit locator. log2(area of earth / 9m^2) is 45.7. Packing bits into phrases is also useful for passwords (https://rmmh.github.io/abbrase/ https://rmmh.github.io/abbrase/), but in my experience the increased difficulty of correctly remembering phrases from a large wordlist outweighs the additional entropy. 4 words chosen from a 2800-word list would convey the same amount of information, and be less prone to confusion. It looks like they're not attempting to make the triplets have consistent meanings between languages, which makes sense -- 40,000 word correspondences between 10 languages would be exceedingly difficult! logs.broker.remote is sweight.saum.zulässige is lodos.pasado.ninguno, none of which are the same meanings. Another improvement would be a hierarchical system-- you can specify a more coarse location using more common words -- picking from a wordlist of 500 for a 4km^2 specifier, 2000 for for a 16 acre plot, 10000 for a 500m^2 area.

Bromskloss 10y ago
> Packing bits into phrases is also useful for passwords (https://rmmh.github.io/abbrase/ https://rmmh.github.io/abbrase/), but in my experience the increased difficulty of correctly remembering phrases from a large wordlist outweighs the additional entropy. I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) First, you generate random data with enough entropy for a passphrase. Then, instead of encoding it in a sequence of words that is as short as possible, you encode it in many (say, a million) sequences that are a bit longer. Each sequence thus encode the same data. Now, you feed all these sequences through an algorithm that gives each sequence a score depending on how close it is to being a natural-language phrase. Finally, you present the user with the sequences, ordered by their score, and let the user choose any one of the to use as passphrase.
- Scaevolus 10y ago
  I don't know that paper, but that's similar to what's going in Abbrase. It shows the best-scored mnemonic using bigram and frequency heuristics, but you could show more alernatives to let users choose their own mnemonic. You can see multiple alternative mnemonics using `abbrase.py -m` -- it hasn't been implemented in the web version yet. It does give better results, from "wave several ominous silence" (default based on heuristic score) to "waves sever ominous silk" or "wavy seven omitted silver" (human-chosen mnemonics).
- kerkeslager 10y ago
  > I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) DiceWare[1] doesn't do the filtering you're talking about, but it does provide a method of generating passphrases by converting entropy into words. PGP Word Lists[2] use a packing technique as well, with even/odd words for error detection. I haven't seen the paper you're talking about, but I'm highly suspicious of using an algorithm to score phrases by how close to natural language they are without a proof of security. If you score natural-ness using, for example, comparing overlapping 2-word patterns to a database, then that database becomes a Markov chain database we can use to generate passphrase guesses, greatly reducing the entropy. Generating and discarding the patterns database from natural language material for each passphrase generation helps only inasmuch as two source databases from the same language are likely to differ. Maybe that's not the method used to test natural-ness, but I suspect that the better the natural-ness scoring function is, the better the corresponding passphrase generator will be. And remember, the user is going to decrease entropy even further by choosing their passphrase. You can mitigate this by decreasing the number of passwords generated for the user to choose from, but this means less natural phrases. You can also mitigate it by increasing the passphrase space (that is, more words in your passphrase) but that decreases memorability. Personally, I use 5-word DiceWare passphrases for most things, and 6-word DiceWare passphrases for the most important stuff. The proof of security for DiceWare is simple enough that you can do it yourself and be confident in it. The intent is not long-term memorability--in the age of leaked passwords stored or transferred in plaintext, password reuse is foolish, and I've yet to come across a scheme that allows me to memorize 30+ passwords. Instead the idea is short-term memorability so I can copy the passwords manually from my password manager. In practice the memorability is completely adequate for this purpose. And even at 5 DiceWare-generated words, that's 2.8x10^19 possibilities, or a little under a year for an attacker with 1 trillion guesses per second capabilities. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [2] https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list
  - Bromskloss 10y ago
    > I'm highly suspicious of using an algorithm to score phrases by how close to natural language they are without a proof of security. To clarify, all the phrases to be scored represent the same random data. They are just more or less difficult to remember. The natural-language algorithm is just there to help you find one that is easy to remember, and is not security critical. The algorithm is assumed to be known to be known to the attacker in any case.
Scaevolus 10y ago
Oh, the wordlists for non-English languages are smaller (25,000 words each)! This makes sense, since English has a particularly large vocabulary. Ocean squares (and Antarctica) don't appear to be localized -- log2(25000^3) = 43.82 > log2((land area of earth - area of antarctica) / 9m^2) = 43.8.

Bromskloss 10y ago

> Packing bits into phrases is also useful for passwords (https://rmmh.github.io/abbrase/ https://rmmh.github.io/abbrase/), but in my experience the increased difficulty of correctly remembering phrases from a large wordlist outweighs the additional entropy. I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) First, you generate random data with enough entropy for a passphrase. Then, instead of encoding it in a sequence of words that is as short as possible, you encode it in many (say, a million) sequences that are a bit longer. Each sequence thus encode the same data. Now, you feed all these sequences through an algorithm that gives each sequence a score depending on how close it is to being a natural-language phrase. Finally, you present the user with the sequences, ordered by their score, and let the user choose any one of the to use as passphrase.

Scaevolus 10y ago
I don't know that paper, but that's similar to what's going in Abbrase. It shows the best-scored mnemonic using bigram and frequency heuristics, but you could show more alernatives to let users choose their own mnemonic. You can see multiple alternative mnemonics using `abbrase.py -m` -- it hasn't been implemented in the web version yet. It does give better results, from "wave several ominous silence" (default based on heuristic score) to "waves sever ominous silk" or "wavy seven omitted silver" (human-chosen mnemonics).
kerkeslager 10y ago
> I saw a paper with a nice method for generating passphrases. Unfortunately, I can't find it. (Can anyone help me?) DiceWare[1] doesn't do the filtering you're talking about, but it does provide a method of generating passphrases by converting entropy into words. PGP Word Lists[2] use a packing technique as well, with even/odd words for error detection. I haven't seen the paper you're talking about, but I'm highly suspicious of using an algorithm to score phrases by how close to natural language they are without a proof of security. If you score natural-ness using, for example, comparing overlapping 2-word patterns to a database, then that database becomes a Markov chain database we can use to generate passphrase guesses, greatly reducing the entropy. Generating and discarding the patterns database from natural language material for each passphrase generation helps only inasmuch as two source databases from the same language are likely to differ. Maybe that's not the method used to test natural-ness, but I suspect that the better the natural-ness scoring function is, the better the corresponding passphrase generator will be. And remember, the user is going to decrease entropy even further by choosing their passphrase. You can mitigate this by decreasing the number of passwords generated for the user to choose from, but this means less natural phrases. You can also mitigate it by increasing the passphrase space (that is, more words in your passphrase) but that decreases memorability. Personally, I use 5-word DiceWare passphrases for most things, and 6-word DiceWare passphrases for the most important stuff. The proof of security for DiceWare is simple enough that you can do it yourself and be confident in it. The intent is not long-term memorability--in the age of leaked passwords stored or transferred in plaintext, password reuse is foolish, and I've yet to come across a scheme that allows me to memorize 30+ passwords. Instead the idea is short-term memorability so I can copy the passwords manually from my password manager. In practice the memorability is completely adequate for this purpose. And even at 5 DiceWare-generated words, that's 2.8x10^19 possibilities, or a little under a year for an attacker with 1 trillion guesses per second capabilities. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [2] https://en.wikipedia.org/wiki/PGP_word_list https://en.wikipedia.org/wiki/PGP_word_list
- Bromskloss 10y ago
  > I'm highly suspicious of using an algorithm to score phrases by how close to natural language they are without a proof of security. To clarify, all the phrases to be scored represent the same random data. They are just more or less difficult to remember. The natural-language algorithm is just there to help you find one that is easy to remember, and is not security critical. The algorithm is assumed to be known to be known to the attacker in any case.

Scaevolus 10y ago

Oh, the wordlists for non-English languages are smaller (25,000 words each)! This makes sense, since English has a particularly large vocabulary. Ocean squares (and Antarctica) don't appear to be localized -- log2(25000^3) = 43.82 > log2((land area of earth - area of antarctica) / 9m^2) = 43.8.