4 ms·

At very least that is more secure than a random 9 character password and much easier to remember. 9 words to the power of 20k[0] compared to 9 letters to the po

At very least that is more secure than a random 9 character password and much easier to remember. 9 words to the power of 20k[0] compared to 9 letters to the power of 52 (random case). [0]http://www.lingholic.com/how-many-words-do-i-need-to-know-the-955-rule-in-language-learning-part-2/ http://www.lingholic.com/how-many-words-do-i-need-to-know-th...

loup-vaillant 10y ago
You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests. Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short. Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.
- cmdrfred 10y ago
  I agree the way you describe is even better. That said if the previous posters password isn't enough entropy for your use case some form of 2 factor auth should come into play as well.
- lmm 10y ago
  > You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.
  - loup-vaillant 10y ago
    I'm not sure your average English word has as much as five characters on average. Okay, let's count this paragraph. 91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.
    - lmm 10y ago
      A single example coming up as 13 is not remotely enough justification to say 14-15 is wrong.

loup-vaillant 10y ago

You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. Some words are way more common than others, and they are much more likely to be found in your passphrase if you didn't use an external random index generator (be it a set of dice or /dev/urandom), because of availability bias: you're more likely to chose common words, or even worse, uncommon words pertaining to your interests. Diceware uses a smaller set (about 8K words), but if you select them truly randomly, you'll get close to 13 bits of entropy per word —guaranteed. I wouldn't cry too much over the loss of 2 bits per word, because Diceware words tend to be short. Then again, even a word in a grammatically correct sentence is likely to have more than the 6-7 bits of entropy a character may have. I wouldn't bet on anything above 10, though.

cmdrfred 10y ago
I agree the way you describe is even better. That said if the previous posters password isn't enough entropy for your use case some form of 2 factor auth should come into play as well.
lmm 10y ago
> You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly. I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.
- loup-vaillant 10y ago
  I'm not sure your average English word has as much as five characters on average. Okay, let's count this paragraph. 91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.
  - lmm 10y ago
    A single example coming up as 13 is not remotely enough justification to say 14-15 is wrong.