4 ms·

To do this formally, you need to consider information entropy. This is all about how you generated your password. 10 characters of totally random mixed case, nu

• samstave 9y ago
  I would love to see a comparison between where physically and which modifiers are used for each character are, and the strength of a password. Is a password which is very easy/comfortable to type out physically any more/less strong than another of the same length? I ask this because I often use a visual pattern on the keyboard for a password and I don't recall which characters they may be, but I recall the pattern in need to type out on a qwerty kb
  • Laforet 9y ago
    Depends on how good the pattern is, however entropy is lower all likelihood because the layout of qwerty keyboard is standardised. Most password crackong dictionary already include common keyboard patterns sich as "qwerfdsazxcv" or variations of it.
• joshjje 9y ago
  There was a nice comic/picture of this. I tend to follow it. Basically using 3-4 short words as a phrase instead of random characters. You can toss special characters inbetween/before/after. They are also much easier to remember. Password "FoolMeOnce!ShameOnMe" for example.
  • freeflight 9y ago
    For completeness sake, this is probably the comic you are referencing: https://xkcd.com/936/ https://xkcd.com/936/
    • shpx 9y ago
      curl -s https://raw.githubusercontent.com/first20hours/google-10000-english/master/google-10000-english-no-swears.txt | shuf | head -n 4 | tr '\n' ' '; echo mine wear vacation mostly log2(10^16) = 53 bits of entropy or 300 years if your attacker can do a million guesses per second (the link says 1000 keys per second, but that's on the CPU). You could also use `cat /usr/share/dict/words` instead of the `curl`, which is a much larger word list, but you get impractical passwords like "globular cellulose's malnutrition's dangling".
      • icebraining 9y ago
        Careful, shuf is not cryptographically safe by default! You need to pass --random-source=/dev/urandom to get a proper RNG. https://www.gnu.org/software/coreutils/manual/html_node/Random-sources.html https://www.gnu.org/software/coreutils/manual/html_node/Rand...
        • shpx 9y ago
          Why does shuf implement its own random number generator? Why isn't /dev/urandom the default? https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ https://sockpuppet.org/blog/2014/02/25/safely-generate-rando...
          • icebraining 9y ago
            shuf is not a crypto tool, and the GNU coreutils are written to be cross-platform, even where /dev/urandom doesn't exist, or is unreliable. That's my guess, at least.
    • joshjje 9y ago
      Nice, yes that was the one, thanks.
  • deleted 9y ago
    [deleted]
  • Dylan16807 9y ago
    But you've gone and picked only one preexisting phrase, instead of independently-random words. That cripples the security of your password. Making a phrase is okay, but you have to start with actually-random words.
    • joshjje 9y ago
      Well, it was an example, but I agree. For everything that I can I use keepass with better autogenerated random passwords, but for things like home WiFi and others that I may have to type in manually I'll use a phrase like this. A more random phrase is certainly more secure.
• column 9y ago
  That diceware system is complete Snowden-level paranoia. Close the curtains! Burn after reading! For everyday techie joe a passphrase + a memorized complex password is just enough. If you're on the internet asking for a strong password method and reading diceware.com you may have your priorities set wrong like an untrained spy. https://duckduckgo.com/?q=pwgen+strong+10&ia=answer https://duckduckgo.com/?q=pwgen+strong+10&ia=answer