4 ms·
If you're asking what I'm using myself, I use 5 random words from the COED (240,000 words). If you want to stick to a 10,000 word list you can just up the wo
by nebulous1 8y ago
If you're asking what I'm using myself, I use 5 random words from the COED (240,000 words). If you want to stick to a 10,000 word list you can just up the word count. Every word you add makes it 10,000 times stronger.
- lvh 8y agoGood for you -- but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality. The argument is not "under literally all circumstances is it worse", but just rather, "it's worse". For that argument to hold, it just has to be plausible worse at least on average. All empirical data we have on password quality points in that direction.
- nebulous1 8y ago> but I hope you'll agree that even 4*rand(10k) is a pretty gracious assumption for password quality I do. However, for it to be "worse" than plaintext you still need to be using it somewhere else, and (previously unmentioned) for the attacker to have a feasible way of attacking the other use. For instance if it's your desktop password, an attacker may have no way of leveraging that (not that I'm saying this overlap is a good thing security-wise). Whereas if they have your unencrypted ssh key then they 100% have your ssh key, no work required, no AWS instance, no cost. I don't want to get too bogged down in this. I was using the old format, and I've now changed, so thank you!