4 ms·

I don't think those rules reduce the entropy significantly, maybe 1 bit compared to a rule of "any character on a US keyboard, max length 12". You can try gener

I don't think those rules reduce the entropy significantly, maybe 1 bit compared to a rule of "any character on a US keyboard, max length 12". You can try generating a random password with that rule and see if it passes the test - more than half of the time it will. The problem with overly restrictive password rules is not generally a lack of entropy. It's that people can't remember their passwords, which might be a bug or a feature.

tyingq 7y ago
I'd like the see the math on that 1 bit reduction. There's 3 "at least one char must be" and the first char must be 0-9a-Z. If the password is 8 characters, half of them, at least, have a much reduced search space.
- dmurray 7y ago
  There are 100 million more 12-character passwords than 8-character ones, so if you randomly choose from all 8-12 character passwords, it's pretty close to just saying "choose a 12-character password". Let's say the alphabet is 93 characters (lower case, upper case, numbers, and the 31 special characters listed). So consider a random 8- to 12-character string in that alphabet. 1% of the strings have fewer than 12 characters. Lots of them will be legal, but let's eliminate them all to be conservative. 31/93 of the strings start with an illegal character, so that eliminates 33% of the strings. About 10 * 1/97 * 1/97 will have three consecutive occurrences of the same character. That eliminates another 0.1%. (83/93) to the power of 11 will have no numbers. That eliminates 28% of the remainder, or 18% of the total. By the same logic, 1% will have no special symbol. A negligible amount have no letter. One password in a million might contain the user's ID (supposing the IDs are 7-digit strings - either way, it will be negligible). Likewise there aren't many random passwords which will be the user's previous password or contain his name. That eliminated 53% of random passwords, leaving 47% for a loss of very close to one bit of entropy. This analysis wasn't completely rigorous as some of the requirements overlap, but if you try it through simulation I'm sure the result will be between 0.7 and 1.7 bits lost.

tyingq 7y ago

I'd like the see the math on that 1 bit reduction. There's 3 "at least one char must be" and the first char must be 0-9a-Z. If the password is 8 characters, half of them, at least, have a much reduced search space.

dmurray 7y ago
There are 100 million more 12-character passwords than 8-character ones, so if you randomly choose from all 8-12 character passwords, it's pretty close to just saying "choose a 12-character password". Let's say the alphabet is 93 characters (lower case, upper case, numbers, and the 31 special characters listed). So consider a random 8- to 12-character string in that alphabet. 1% of the strings have fewer than 12 characters. Lots of them will be legal, but let's eliminate them all to be conservative. 31/93 of the strings start with an illegal character, so that eliminates 33% of the strings. About 10 * 1/97 * 1/97 will have three consecutive occurrences of the same character. That eliminates another 0.1%. (83/93) to the power of 11 will have no numbers. That eliminates 28% of the remainder, or 18% of the total. By the same logic, 1% will have no special symbol. A negligible amount have no letter. One password in a million might contain the user's ID (supposing the IDs are 7-digit strings - either way, it will be negligible). Likewise there aren't many random passwords which will be the user's previous password or contain his name. That eliminated 53% of random passwords, leaving 47% for a loss of very close to one bit of entropy. This analysis wasn't completely rigorous as some of the requirements overlap, but if you try it through simulation I'm sure the result will be between 0.7 and 1.7 bits lost.