4 ms·
I never said any part of the post was a lie. Most people's passwords are not random. The word "password" doesn't mean random. So there isn't a reason to assume
by Buge 9y ago
I never said any part of the post was a lie. Most people's passwords are not random. The word "password" doesn't mean random. So there isn't a reason to assume that the password is random. xkcd's recommended password is 25 characters, and 44 bits of entropy. Extrapolating that out would mean a 46 character password would be 81 bits of entropy.
Yes, "from the full set" likely means that it's higher than 1.46 bits/character. But it doesn't mean it's much more.
- stouset 9y agoAt the point where someone has a 46-character password consisting of uppercase, lowercase, digits, and symbols that takes a week to memorize, I think it’s a fair guess that it’s random. The average password isn’t random. But GP was not describing anything remotely close to an average password in the first place. Turns out (according to GP) it isn’t random. But I stand by my point that it was a reasonable assumption given the available data.