4 ms·

Passwords, on average, have around 40 bits of entropy (or 0 if they're in any existing list, and some lists are 500M strong) so don't us pass words. Also, TLS

Passwords, on average, have around 40 bits of entropy (or 0 if they're in any existing list, and some lists are 500M strong) so don't us pass words. Also, TLS is MITM-able (the CA system is one giant backdoor, CT doesn't prevent MITM attacks) so you're password and authenticated token can be captured and your account can be pwnd. Don't use pass words. Use mnemonics to derive public/private keys and use authenticated encryption (see lib sodium) or separate signatures and encryption. Some of my explorations here (work in progress) https://docs.google.com/presentation/d/1f2k6fsIkDmIS1WyJAT0lXQmDuHIPeo9GDKfP1FY2rVc/edit?usp=sharing https://docs.google.com/presentation/d/1f2k6fsIkDmIS1WyJAT0l...

csande17 7y ago
> Passwords, on average, have around 40 bits of entropy (or 0 if they're in any existing list, and some lists are 500M strong) If you choose a password by randomly selecting from a list of 500M passwords, surely it has log_2(500,000,000) ~= 29 bits of entropy?
tialaramex 7y ago
These are ramblings by a Coiner. As is usual for a Coiner since you don't really understand what you're talking about we get pages of vaguely related stuff sort of thrown together in the hopes that it covers roughly whatever it is you're claiming this time. Let's take the "insufficient serial entropy" as one very clear example. That was a Brown M&M and not an actual technical concern, but you haven't understood that at all and just linked it as part of a claim this is "Security Theater". Several of your links supposedly about "HTTPS snooping by Governments, Employers and Hackers" aren't about HTTPS, or even TLS, or even the Web PKI, but instead unrelated "certificates" of one sort or another than you apparently didn't understand weren't the same thing. For example the Apple Insider article is about Apple's iPhone application signing. And then your "solution" ends up relying on all the same infrastructure you've wasted slides decrying as subject to MITM, including both HTTPS itself and OS-specific code signing. Get out of here with that Coiner nonsense.

csande17 7y ago

> Passwords, on average, have around 40 bits of entropy (or 0 if they're in any existing list, and some lists are 500M strong) If you choose a password by randomly selecting from a list of 500M passwords, surely it has log_2(500,000,000) ~= 29 bits of entropy?

tialaramex 7y ago

These are ramblings by a Coiner. As is usual for a Coiner since you don't really understand what you're talking about we get pages of vaguely related stuff sort of thrown together in the hopes that it covers roughly whatever it is you're claiming this time. Let's take the "insufficient serial entropy" as one very clear example. That was a Brown M&M and not an actual technical concern, but you haven't understood that at all and just linked it as part of a claim this is "Security Theater". Several of your links supposedly about "HTTPS snooping by Governments, Employers and Hackers" aren't about HTTPS, or even TLS, or even the Web PKI, but instead unrelated "certificates" of one sort or another than you apparently didn't understand weren't the same thing. For example the Apple Insider article is about Apple's iPhone application signing. And then your "solution" ends up relying on all the same infrastructure you've wasted slides decrying as subject to MITM, including both HTTPS itself and OS-specific code signing. Get out of here with that Coiner nonsense.