4 ms·
I guess this is a good primer for some folks, but there are two really spurious arguments: (1) Your working vocabulary of 20k words is irrelevant. If you pick
by evrydayhustling 8y ago
I guess this is a good primer for some folks, but there are two really spurious arguments:
(1) Your working vocabulary of 20k words is irrelevant. If you pick the words yourself, they aren't random and your random-word-vocabulary (the ones you'd actually pick) is waaaay less. If you use a randomizer, which you should, just give it the full dictionary (or say, top 100k for memorability).
(2) Faced with the suggestion of adding more words, they show that 4 is crackable. But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect. This article should be as simple as "use 5 random words, not 4".
Password managers have their own issues, both with usability and their tendency to provide centralized targets. And, they still require a secure passkey themselves -- for which a long random phrase is a perfectly reasonable approach.
- closetohome 8y ago> "use 5 random words, not 4" But that would actually be useful, and get fewer hits.
- PaulMoore 8y agoHi evrydayhustling "If you use a randomizer, which you should" That's a big IF. People should use a password manager, or create unique random passwords for every site... but they don't. Of course, if someone other than you chooses the words, you'd need to include the entire dictionary. "But go to 5, and you're solid for 400y. This is so clearly relevant that excluding it seems suspect." I haven't excluded this; I make reference to DiceWare at the bottom of the page. This covers both using more words chosen at random, which is the entire point. Thanks
- evrydayhustling 8y agoOops - I didn't notice this part was related because I haven't used diceware! I still think it's weird to put something this fundamental to your argument in a footnote under one product above, but apologies for implying you if ignored it entirely.