3 ms·

How is remembering the pass-sentences different from remembering passwords?

by shib71 16y ago

kylemaxwell 16y ago
Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols. You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".
- guygurari 16y ago
  I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, since you're led to believe these SHA1 passwords give you the same security as standard, locally-stored generated passwords.
  - kylemaxwell 16y ago
    I'd have to think more about this particular tool, but I remember seeing some calculations that passphrases have greater total entropy than random passwords, even if it takes more characters to get the same amount of entropy. Generally speaking, I go with the mnemonics, myself, rather than something like this.
    - ars 16y ago
      There are about 50,000 commonly used words in English. That means that each word has an entropy of about 15.6 bits. (Probably less since some words are far more common than others.) Using a typical 4 word phrase gets you about 62 bits of entropy. In contrast a password can select from a set of about 72 characters. i.e. 6.1 bits per letter. Using an 10 character password gets you about 61 bits of entropy. So they seem reasonably comparable. It would be nice to redo the calculation while accounting for how common each word is, and also that special characters are used less often in passwords.
      - darklajid 16y ago
        Could you help me understand your reasoning/calculation? I'd like to verify it with my expectations for a passphrase: - not-so-common (non-)words (think meme, Shakespeare style English, abbreviations/artifical words -> Jedi, Klingon, whatever) - I'd like to understand how to valuate punctuation: You don't just need to guess the passphrase, you might need to pepper it with commas, quotes, dots, question/exclamation marks at the right spots
        ars 16y ago
        Punctuation adds to the entropy of course. Although if there are only 5 of so symbols it doesn't add a lot, and if the punctuation is placed grammatically correctly it hardly adds anything. It's not a problem to include non-english words in your dictionary. But made up words are basically passwords, and are no longer phrases. If you choose a sequence of words that are more likely to go together that reduces the entropy. Basically you are trying to see how random your phrase is, and the "stranger" it is, the more random.
      - tel 16y ago
        So they seem reasonably comparable... It would be nice to redo the calculation while accounting for how common each word is, and also that special characters are used less often in passwords. I know this was a rough estimate, but I think it is way, way off. Passphrases are not usually generated by random choice of English words but are instead a particular, meaningful English sentence. This means not only are you dealing with word distribution nonuniformity but word history correlations. Without doing any math in particular, let's pick a typical 4 word phrase (literally, I'm opening the book in front of me and looking for a 4 word sentence.) "This will be natural" In all honestly, this is closer to a combination of a subject (with a great deal less entropy since familiar subjects are common) a tense, and an adjective. I think you'd be lucky if there were 2^18 sentences of similar complexity, let alone 2^62. In comparison, four random words drawn from an English dictionary. "idiocy rammer stars cookshop" Passphrases of this class might have closer to 62 bits of entropy. So what does this mean? In all likelihood, if passphrases become more common, we'll see language model based cracking routines which generate billions of sensible English sentences to crack these passwords. Length is no protection ("abcedfghijklmnopqrstuvwxyz1234567890"). Anything with genuinely high entropy is by definition difficult to remember.
  - asfsdfljlkjf 16y ago
    Passwords are not "security by obscurity".
    - guygurari 16y ago
      No. The difference between passwords and this is.
    - noahl 16y ago
      The "obscurity" is the idea that an attacker would not know that you were generating your passwords by SHA-1 hashing a passphrase. If the attacker did not know that, they could only brute-force your account by trying every possible string of characters, which is fine, because there are a lot of those. If, however, they knew what you were doing, then they could generate a list of likely-seeming passphrases, hash those, and try those hashes as passwords. If there are fewer likely passphrases than there are strings of characters, this shrinks their search space. Also, once they know you're using passphrases, they might also know that some phrases are much more likely than others, so they could try those first. This would give them a good chance of finding your password even more quickly.

How is remembering the pass-sentences different from remembering passwords?

by shib71 16y ago

How is remembering the pass-sentences different from remembering passwords?

Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols. You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".

guygurari 16y ago
I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, since you're led to believe these SHA1 passwords give you the same security as standard, locally-stored generated passwords.
- kylemaxwell 16y ago
  I'd have to think more about this particular tool, but I remember seeing some calculations that passphrases have greater total entropy than random passwords, even if it takes more characters to get the same amount of entropy. Generally speaking, I go with the mnemonics, myself, rather than something like this.
  - ars 16y ago
    There are about 50,000 commonly used words in English. That means that each word has an entropy of about 15.6 bits. (Probably less since some words are far more common than others.) Using a typical 4 word phrase gets you about 62 bits of entropy. In contrast a password can select from a set of about 72 characters. i.e. 6.1 bits per letter. Using an 10 character password gets you about 61 bits of entropy. So they seem reasonably comparable. It would be nice to redo the calculation while accounting for how common each word is, and also that special characters are used less often in passwords.
    - darklajid 16y ago
      Could you help me understand your reasoning/calculation? I'd like to verify it with my expectations for a passphrase: - not-so-common (non-)words (think meme, Shakespeare style English, abbreviations/artifical words -> Jedi, Klingon, whatever) - I'd like to understand how to valuate punctuation: You don't just need to guess the passphrase, you might need to pepper it with commas, quotes, dots, question/exclamation marks at the right spots
      - ars 16y ago
        Punctuation adds to the entropy of course. Although if there are only 5 of so symbols it doesn't add a lot, and if the punctuation is placed grammatically correctly it hardly adds anything. It's not a problem to include non-english words in your dictionary. But made up words are basically passwords, and are no longer phrases. If you choose a sequence of words that are more likely to go together that reduces the entropy. Basically you are trying to see how random your phrase is, and the "stranger" it is, the more random.
    - tel 16y ago
      So they seem reasonably comparable... It would be nice to redo the calculation while accounting for how common each word is, and also that special characters are used less often in passwords. I know this was a rough estimate, but I think it is way, way off. Passphrases are not usually generated by random choice of English words but are instead a particular, meaningful English sentence. This means not only are you dealing with word distribution nonuniformity but word history correlations. Without doing any math in particular, let's pick a typical 4 word phrase (literally, I'm opening the book in front of me and looking for a 4 word sentence.) "This will be natural" In all honestly, this is closer to a combination of a subject (with a great deal less entropy since familiar subjects are common) a tense, and an adjective. I think you'd be lucky if there were 2^18 sentences of similar complexity, let alone 2^62. In comparison, four random words drawn from an English dictionary. "idiocy rammer stars cookshop" Passphrases of this class might have closer to 62 bits of entropy. So what does this mean? In all likelihood, if passphrases become more common, we'll see language model based cracking routines which generate billions of sensible English sentences to crack these passwords. Length is no protection ("abcedfghijklmnopqrstuvwxyz1234567890"). Anything with genuinely high entropy is by definition difficult to remember.
- asfsdfljlkjf 16y ago
  Passwords are not "security by obscurity".
  - guygurari 16y ago
    No. The difference between passwords and this is.
  - noahl 16y ago
    The "obscurity" is the idea that an attacker would not know that you were generating your passwords by SHA-1 hashing a passphrase. If the attacker did not know that, they could only brute-force your account by trying every possible string of characters, which is fine, because there are a lot of those. If, however, they knew what you were doing, then they could generate a list of likely-seeming passphrases, hash those, and try those hashes as passwords. If there are fewer likely passphrases than there are strings of characters, this shrinks their search space. Also, once they know you're using passphrases, they might also know that some phrases are much more likely than others, so they could try those first. This would give them a good chance of finding your password even more quickly.