3 ms·

This is my understanding, could be missing something though: The comic proposes that correcthorsebatterystaple would be a secure password. It is 26 characters

This is my understanding, could be missing something though: The comic proposes that correcthorsebatterystaple would be a secure password. It is 26 characters long and contains 4 basic english words that would be in even the smallest of dictionaries. Let's say a dictionary with 100.000 entries contains these words. Combining 4 words in the dictionary gives you 100,000^4 = 1.e+20 possibilities. Not bad, but let's say 15 random uppercase and lowercase (like the first letters of every word in a phrase like Schneier proposes) letters give you (26+26)^15 = 5.49e+25, still 5 orders of magnitude better. Edit: a phrase with 26 words in to take each letter from indeed isn't doable to remember, changed it to 15.

germanier 10y ago
100k words might be a bit to many for a dictionary of words that are easy to remember. The comic proposes using not enough entropy (i.e. you should use more than four random words). The Schneier method is basically equivalent but with important caveats: 1) Such a phrase is not randomly chosen but follows at minimum basic English grammar and at worst is well-known and thus part of the attacker's dictionary and 2) even if that is taken account for the first letters are not distributed uniformly across the alphabet, you just need to take a look at any (printed) dictionary. That greatly reduces entropy and makes it hard to reliably estimate entropy.
- creshal 10y ago
  > 100k words might be a bit to many for a dictionary of words that are good to remember. I've been generating all my (memorized) passwords from a 120k word dictionary for years now, can't complain. And estimating the entropy is easy.
  - germanier 10y ago
    Easy entropy calculation is the beauty of that method. But for "take the first letters in an English phrase" you can't just do (2*26)^{length} or you are way overestimating.
hollander 10y ago
Why limit yourself to one language? You could even use dialects. Five words, five languages, and not too common words.

germanier 10y ago

100k words might be a bit to many for a dictionary of words that are easy to remember. The comic proposes using not enough entropy (i.e. you should use more than four random words). The Schneier method is basically equivalent but with important caveats: 1) Such a phrase is not randomly chosen but follows at minimum basic English grammar and at worst is well-known and thus part of the attacker's dictionary and 2) even if that is taken account for the first letters are not distributed uniformly across the alphabet, you just need to take a look at any (printed) dictionary. That greatly reduces entropy and makes it hard to reliably estimate entropy.

creshal 10y ago
> 100k words might be a bit to many for a dictionary of words that are good to remember. I've been generating all my (memorized) passwords from a 120k word dictionary for years now, can't complain. And estimating the entropy is easy.
- germanier 10y ago
  Easy entropy calculation is the beauty of that method. But for "take the first letters in an English phrase" you can't just do (2*26)^{length} or you are way overestimating.

hollander 10y ago

Why limit yourself to one language? You could even use dialects. Five words, five languages, and not too common words.