3 ms·

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_Engli

Can we really assume 2048 different words? 100 words make up 50% of all words written according to this https://en.wikipedia.org/wiki/Most_common_words_in_English https://en.wikipedia.org/wiki/Most_common_words_in_English ? I was a bit hasty of the entropy of the passphrase, my mistake. I still stand by that even if we choose from 2048 common words, generating a good passphrase (one that isn't a common sentence) is harder than we think.

oneeyedpigeon 10y ago
None of [ "correct", "horse", "battery", "staple" ] are in that 100 list, though.
croon 10y ago
I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words https://github.com/dwyl/english-words
- hvidgaard 10y ago
  There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.
  - rsanders 10y ago
    I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".
  - aangjie 10y ago
    Err.. I would suspect most(non-english?) people on the internet to know 2000 words. (By virtue of being atleast bi-lingual, they would, so the challenge boils down to can they type it? unicode support should help, but I've found most cases people simply type those sounds in English.) As for the English as a primary language people, I've no clue about the number of words, but if we can expect them to type 1024 words, we'd still get 20 bits..
  - slavik81 10y ago
    "Average native test-takers of age 4 already know 5,000 words." http://www.economist.com/blogs/johnson/2013/05/vocabulary-size http://www.economist.com/blogs/johnson/2013/05/vocabulary-si...
    - hvidgaard 10y ago
      Know and ability to spell are two completely different things.
  - marcosdumay 10y ago
    Eh, you may want to peek at the XKCD things explainer to see what is life under 1k words. Everybody uses more than a few thousand words on at least one language. And selecting the least used ones will make your passprhases easier to memorize, because they have much more concrete meaning (by virtue of their rarity) than the most used words.
mjevans 10y ago
You can if it's a computer picking the password from presumably common words. If the human is picking anything than there WILL be a bias in selection. Effort should be made at minimizing that, but even with education this is a difficult task for any worker. It got to the point where I actually took a classic literary work and made a 'password words' dictionary from it just so that I could have the computer generate possible new passwords. (there bias is mostly filtering out things that might be offensive... because someone can always take it the wrong way even if you explain in advance the theory of how the password was created by a computer).
- iamatworknow 10y ago
  I've been pretty happy using diceware[0] for my word-based passwords. Just be sure to use actual dice and not a software based random number generator if you want it to be truly random. [0]http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
hollander 10y ago
Mix in some other languages or slang words, and a number is always possible and easy to remember. You may choose to replace the space consequently with a comma or ; or another easy to type character (not one that requires a shift if you keep everything lowercase).
kevhito 10y ago
Yes, 2048 is tiny. I've been using a 4096-word dictionary I found online for years, along with my family and two kids since they were about 6 years old. There is absolutely no trouble with a 4096 word dictionary. Yes, they (and me too) sometimes bump into words we don't recognize, but it's not that common. Here, I just generated you a few passwords: * hefty march attempt force bowel scuff * between sepia book sweat lemma saint * safe warn magical cask hefty wish * alum glib puck adieu dour lazy * telephone pine cavort good knee swank * numeral plan jewel conch slate tube * pastry piano sure proxy unit brew * trig rise taint current sans gallop Here is the same random numbers but encoded into ascii instead of words: * 81Pk3t?Rq6S} * ]CPcYrT^?iE3 * +qV`J9ZU&.,C * `>sp=~V);3g> * E&_ff7a|Z4B[ * ?OX~[J>0K'S* These each have the exact same amount of entropy as the word-based ones.
- kisstheblade 10y ago
  Yes and good luck writing those passwords like "between sepia book sweat lemma saint" without typos :) I just watched a friend using some kind of long password and it took about a minute to get the password correctly entered. Easy to look at the keyboard also when he was typing and guess the words used.
  - paulddraper 10y ago
    Better that then 81Pk3t?Rq6S}
leshow 10y ago
BIP39 uses a wordslist of 2048 words, it selects 12 words to generate a passphrase. I believe the target is 128 bits of entropy.
squeaky-clean 10y ago
The GfyCat URL generator list is about ~1800 animals and ~8000 adjectives [0]. All fairly memorable words. Add in other types of words and 2048 quickly becomes a small number. The words don't have to be incredibly simple, either. Grabbing a random GfyCat image from the front page gives me "OrangeLankyBasilisk" which is easy to remember, none of those words are particularly foreign. But they're not in your list of most common words, nor are any of them in XKCD's simplewriter [1], which keeps track of the 1000 most common words. [0] https://github.com/a-type/adjective-adjective-animal/tree/master/lib/lists https://github.com/a-type/adjective-adjective-animal/tree/ma... [1] https://xkcd.com/simplewriter/ https://xkcd.com/simplewriter/ Edit: The words need to be randomly chosen by a computer, so it doesn't matter what the most common words are. You could generate the password from a list of 2048 spanish words or japanese words or emojis and the entropy is the same as the previous scenario (assuming the attacker knows your dictionary of symbols just like they'd know your dictionary of English words). If you let a human choose, of course the smiley-face and poop emojis are going to be picked 50% of the time, but that's not the intention of the comic or passphrases.

oneeyedpigeon 10y ago

None of [ "correct", "horse", "battery", "staple" ] are in that 100 list, though.

croon 10y ago

I'd go so far as to say that 2048 words aren't that many. Here's Merriam-Websters 3000 _core_ words [1]. Here's a list of 355k words [2]. [1] http://learnersdictionary.com/3000-words http://learnersdictionary.com/3000-words [2] https://github.com/dwyl/english-words https://github.com/dwyl/english-words

hvidgaard 10y ago
There is not 3000 _core_ words. You don't teach elementary school children 3000 words. That list is significanly smaller. In Denmark it's 120 words, then you'll be well on your way to reading and writing most basic stuff. That someone has selected 2048 words used to generate passphrases, doesn't make it easy to remember.
- rsanders 10y ago
  I've been doing this for years and it is indeed easier to remember. You won't be keeping all your passwords in your head in any format if you're using a unique password per site or service as you should. But you occasionally have to buffer them mentally between your password manager and the input box (especially on mobile), and the same number of bits of entropy are infinitely easier to copy correctly in this format vs something like "?G[G6n|4".
- aangjie 10y ago
  Err.. I would suspect most(non-english?) people on the internet to know 2000 words. (By virtue of being atleast bi-lingual, they would, so the challenge boils down to can they type it? unicode support should help, but I've found most cases people simply type those sounds in English.) As for the English as a primary language people, I've no clue about the number of words, but if we can expect them to type 1024 words, we'd still get 20 bits..
- slavik81 10y ago
  "Average native test-takers of age 4 already know 5,000 words." http://www.economist.com/blogs/johnson/2013/05/vocabulary-size http://www.economist.com/blogs/johnson/2013/05/vocabulary-si...
  - hvidgaard 10y ago
    Know and ability to spell are two completely different things.
- marcosdumay 10y ago
  Eh, you may want to peek at the XKCD things explainer to see what is life under 1k words. Everybody uses more than a few thousand words on at least one language. And selecting the least used ones will make your passprhases easier to memorize, because they have much more concrete meaning (by virtue of their rarity) than the most used words.

mjevans 10y ago

You can if it's a computer picking the password from presumably common words. If the human is picking anything than there WILL be a bias in selection. Effort should be made at minimizing that, but even with education this is a difficult task for any worker. It got to the point where I actually took a classic literary work and made a 'password words' dictionary from it just so that I could have the computer generate possible new passwords. (there bias is mostly filtering out things that might be offensive... because someone can always take it the wrong way even if you explain in advance the theory of how the password was created by a computer).

iamatworknow 10y ago
I've been pretty happy using diceware[0] for my word-based passwords. Just be sure to use actual dice and not a software based random number generator if you want it to be truly random. [0]http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html

hollander 10y ago

Mix in some other languages or slang words, and a number is always possible and easy to remember. You may choose to replace the space consequently with a comma or ; or another easy to type character (not one that requires a shift if you keep everything lowercase).

kevhito 10y ago

Yes, 2048 is tiny. I've been using a 4096-word dictionary I found online for years, along with my family and two kids since they were about 6 years old. There is absolutely no trouble with a 4096 word dictionary. Yes, they (and me too) sometimes bump into words we don't recognize, but it's not that common. Here, I just generated you a few passwords: * hefty march attempt force bowel scuff * between sepia book sweat lemma saint * safe warn magical cask hefty wish * alum glib puck adieu dour lazy * telephone pine cavort good knee swank * numeral plan jewel conch slate tube * pastry piano sure proxy unit brew * trig rise taint current sans gallop Here is the same random numbers but encoded into ascii instead of words: * 81Pk3t?Rq6S} * ]CPcYrT^?iE3 * +qV`J9ZU&.,C * `>sp=~V);3g> * E&_ff7a|Z4B[ * ?OX~[J>0K'S* These each have the exact same amount of entropy as the word-based ones.

kisstheblade 10y ago
Yes and good luck writing those passwords like "between sepia book sweat lemma saint" without typos :) I just watched a friend using some kind of long password and it took about a minute to get the password correctly entered. Easy to look at the keyboard also when he was typing and guess the words used.
- paulddraper 10y ago
  Better that then 81Pk3t?Rq6S}

leshow 10y ago

BIP39 uses a wordslist of 2048 words, it selects 12 words to generate a passphrase. I believe the target is 128 bits of entropy.

squeaky-clean 10y ago

The GfyCat URL generator list is about ~1800 animals and ~8000 adjectives [0]. All fairly memorable words. Add in other types of words and 2048 quickly becomes a small number. The words don't have to be incredibly simple, either. Grabbing a random GfyCat image from the front page gives me "OrangeLankyBasilisk" which is easy to remember, none of those words are particularly foreign. But they're not in your list of most common words, nor are any of them in XKCD's simplewriter [1], which keeps track of the 1000 most common words. [0] https://github.com/a-type/adjective-adjective-animal/tree/master/lib/lists https://github.com/a-type/adjective-adjective-animal/tree/ma... [1] https://xkcd.com/simplewriter/ https://xkcd.com/simplewriter/ Edit: The words need to be randomly chosen by a computer, so it doesn't matter what the most common words are. You could generate the password from a list of 2048 spanish words or japanese words or emojis and the entropy is the same as the previous scenario (assuming the attacker knows your dictionary of symbols just like they'd know your dictionary of English words). If you let a human choose, of course the smiley-face and poop emojis are going to be picked 50% of the time, but that's not the intention of the comic or passphrases.