4 ms·

I'd love to see a study done on this. I have a feeling that a "phrase" password has significantly more entropy than a "character" password of double or even tr

I'd love to see a study done on this. I have a feeling that a "phrase" password has significantly more entropy than a "character" password of double or even triple the length (comparing a word equal to a character length wise). Even taking into account that a real sentence would need to follow a lot of rules, there are still a LOT of adjectives , a LOT of nouns, etc... I'm sure your "meat based" generator is more open to targeted attacks if someone knows your interests or something, but I have a feeling that it's still such a large pool that it's safe. And if you start to include somewhat nonsensical phrases like "correct horse battery staple" that even opens things up more. Include other things like spacing, capitalization, misspellings, made up words, or even prepending or appending a "traditional" password gets you even more still.

rawnlq 10y ago
I don't know how to answer the other parts of your comment, but your "double or even triple length" estimate might be off: From https://en.wikipedia.org/wiki/Entropy_(information_theory) https://en.wikipedia.org/wiki/Entropy_(information_theory) > English text has between 0.6 and 1.3 bits of entropy for each character of message. For comparison if you used a random string of alphanumeric characters it will have lg(26 + 26 + 10) = 5.7 bits per character. So if your password is drawn from an english corpus, if the low end of the estimate is correct, it's only about as strong as a random password 9 times shorter (or 4 on the high end). But of course we don't want a grammatical english password. Question is how much entropy does our meat-based random generator actually lose due to language bias compared to random word selection from an english dictionary (which I don't disagree with the analysis of as long as it's machine generated).
- adzm 10y ago
  Beyond grammar, the addition of intentional errors or symbols or Finnegans Wake can help increase the entropy drastically too.
- camtarn 10y ago
  I wonder how much extra entropy you can add by introducing an extra language or two? For instance, having a password like 'unterwasserboot-sparkle-mocidade-yogurt'. It seems like multilingual folks would be at a distinct advantage here ... at least until you forget which of the words in your password was in which language, and you end up with 'submarine-faisca-jugend-yogurt' instead :)
Dylan16807 10y ago
If you pick completely random words from the dictionary, you get about 17 bits per word. That's worth between two and three random characters. If you take random words and arrange most of them into a sentence then you drop slightly but you're still okay. If you add any common words like "the" or "was", don't include them in your word count. While you could boost it with spacing, capitalization, misspellings, etc. you gain very few bits for each modification you have to remember. You're better off tossing a random character or two onto your phrase, or simply making it a word longer.

rawnlq 10y ago

I don't know how to answer the other parts of your comment, but your "double or even triple length" estimate might be off: From https://en.wikipedia.org/wiki/Entropy_(information_theory) https://en.wikipedia.org/wiki/Entropy_(information_theory) > English text has between 0.6 and 1.3 bits of entropy for each character of message. For comparison if you used a random string of alphanumeric characters it will have lg(26 + 26 + 10) = 5.7 bits per character. So if your password is drawn from an english corpus, if the low end of the estimate is correct, it's only about as strong as a random password 9 times shorter (or 4 on the high end). But of course we don't want a grammatical english password. Question is how much entropy does our meat-based random generator actually lose due to language bias compared to random word selection from an english dictionary (which I don't disagree with the analysis of as long as it's machine generated).

adzm 10y ago
Beyond grammar, the addition of intentional errors or symbols or Finnegans Wake can help increase the entropy drastically too.
camtarn 10y ago
I wonder how much extra entropy you can add by introducing an extra language or two? For instance, having a password like 'unterwasserboot-sparkle-mocidade-yogurt'. It seems like multilingual folks would be at a distinct advantage here ... at least until you forget which of the words in your password was in which language, and you end up with 'submarine-faisca-jugend-yogurt' instead :)

Dylan16807 10y ago

If you pick completely random words from the dictionary, you get about 17 bits per word. That's worth between two and three random characters. If you take random words and arrange most of them into a sentence then you drop slightly but you're still okay. If you add any common words like "the" or "was", don't include them in your word count. While you could boost it with spacing, capitalization, misspellings, etc. you gain very few bits for each modification you have to remember. You're better off tossing a random character or two onto your phrase, or simply making it a word longer.