Agreed. > Well, the theoretical entropy, but not the empirical. Agreed. There are profound implications of that statement of that statement when applied to o

Agreed. > Well, the theoretical entropy, but not the empirical. Agreed. There are profound implications of that statement of that statement when applied to other problems, because we mutually accept the theory as correct, but only theoretically, when we know it has significant limitations in the real world. > You could argue that ruling out "12345678" and "password" and "Password!" reduces the "available entropy" Obviously. And yet, equally obviously, removing those from the rounds because they're preemptively banned reduces the actual number of test hashes we have to run to brute force, and introducing a rule means that we can also eliminate huge swathes of potential keyspace. So, the obvious is not necessarily so obvious after all. This gets more and more interesting the deeper the rabbit hole goes. What if we have extremely random data -- perhaps even raw binary -- but it happens to have a sequence of three arbitrary integers, which is in violation of the rules, and therefore we can eliminate all such passwords from our test cases? That's a potentially huge chunk of entropy.