5 ms·

One little problem with your passphrase is, it's grammatically correct. If the attacker suspects as much, this will dramatically reduce the search space. Pers

One little problem with your passphrase is, it's grammatically correct. If the attacker suspects as much, this will dramatically reduce the search space. Personally, I'd rather bet on something like Diceware.

cmdrfred 10y ago
At very least that is more secure than a random 9 character password and much easier to remember. 9 words to the power of 20k[0] compared to 9 letters to the power of 52 (random case). [0]http://www.lingholic.com/how-many-words-do-i-need-to-know-the-955-rule-in-language-learning-part-2/ http://www.lingholic.com/how-many-words-do-i-need-to-know-th...
- loup-vaillant 10y ago
  You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests. Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short. Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.
  - cmdrfred 10y ago
    I agree the way you describe is even better. That said if the previous posters password isn't enough entropy for your use case some form of 2 factor auth should come into play as well.
  - lmm 10y ago
    > You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.
    - loup-vaillant 10y ago
      I'm not sure your average English word has as much as five characters on average. Okay, let's count this paragraph. 91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.
      - lmm 10y ago
        A single example coming up as 13 is not remotely enough justification to say 14-15 is wrong.
soft_dev_person 10y ago
I tend to do manual "diceware"-passphrase generation when I need to (i.e. I cannot use my password manager for any reason). So just random words and half-words are appended, like: 'misfortune behold oratory plexum' Then again, these things tend to just stick very well in my mind, so it may not be appropriate for everyone. Also, I only need to do this on certain services, so it's not that many to remember. The hard part is when they then reply with "requires at least one upper case character, number, symbol, etc.". A certain XKCD comic comes to mind...
- loup-vaillant 10y ago
  My method: Lorem ipsum random garbage 1 I get a special character (space), lower case, upper case, and numbers. Change the number for rotation, it works if they don't search for short Hamming distances. Worked at my last gig.

cmdrfred 10y ago

At very least that is more secure than a random 9 character password and much easier to remember. 9 words to the power of 20k[0] compared to 9 letters to the power of 52 (random case). [0]http://www.lingholic.com/how-many-words-do-i-need-to-know-the-955-rule-in-language-learning-part-2/ http://www.lingholic.com/how-many-words-do-i-need-to-know-th...

loup-vaillant 10y ago
You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests. Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short. Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.
- cmdrfred 10y ago
  I agree the way you describe is even better. That said if the previous posters password isn't enough entropy for your use case some form of 2 factor auth should come into play as well.
- lmm 10y ago
  > You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.
  - loup-vaillant 10y ago
    I'm not sure your average English word has as much as five characters on average. Okay, let's count this paragraph. 91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.
    - lmm 10y ago
      A single example coming up as 13 is not remotely enough justification to say 14-15 is wrong.

soft_dev_person 10y ago

I tend to do manual "diceware"-passphrase generation when I need to (i.e. I cannot use my password manager for any reason). So just random words and half-words are appended, like: 'misfortune behold oratory plexum' Then again, these things tend to just stick very well in my mind, so it may not be appropriate for everyone. Also, I only need to do this on certain services, so it's not that many to remember. The hard part is when they then reply with "requires at least one upper case character, number, symbol, etc.". A certain XKCD comic comes to mind...

loup-vaillant 10y ago
My method: Lorem ipsum random garbage 1 I get a special character (space), lower case, upper case, and numbers. Change the number for rotation, it works if they don't search for short Hamming distances. Worked at my last gig.