3 ms·
> That would just be "four words plus five random characters". Aye.. if you were going to pick the simplest (most bruteforceable) pattern first, you wouldn't w
by clarry 7y ago
> That would just be "four words plus five random characters".
Aye.. if you were going to pick the simplest (most bruteforceable) pattern first, you wouldn't want five random characters now, would you? I thought that's the whole point of this exercise :-) Of course I could decide to repeat that bit pattern four times and that adds no entropy if the pattern is assumed to be fixed, but then we get back to having the attacker try guess the right pattern.
Very often in these discussion people don't consider the pattern space at all as part of entropy and they only look at the entropy within the alphabet/words/variations after the pattern is fixed. I'm not sure that's right.
- Dylan16807 7y agoThe pattern entropy matters, but it's much smaller than the entropy from the actual words and characters. Don't try to outsmart the person cracking the password. Assume whatever clever scheme you come up with is relatively common. If only 0.05% of passwords use it, that's still less entropy than adding two more characters. And it's a lot safer to underestimate than overestimate.