4 ms·

The average person's working vocabulary is 20,000 words, do you expect a layman to be able to produce a perfectly random combination out of the paltry 20000⁴ po

The average person's working vocabulary is 20,000 words, do you expect a layman to be able to produce a perfectly random combination out of the paltry 20000⁴ possible sequences. Will they reach into the outer edges of their vocabulary to use obscure words? Surely it would be biased towards common words, making even bcrypt pointless.

bradknowles 6y ago
With respect, maybe your vocabulary is 20,000 words, but I submit that the average English-only speaker is more like about 10,000 words. This is a case where I choose to believe xkcd unless and until you can provide convincing evidence otherwise.
- maven29 6y ago
  The total possible permutations of characters in just an alphanumeric 12 digit random password is 36¹², which is around 400 times larger than the number of permutations possible with 4 words picked out of a pool of 10,000 or 10000⁴. This might seem reasonable, however, this is only a false economy as people tend to gravitate towards common words that evoke simple concepts, which drastically reduces the search space. A dictionary attack isn't anything novel and the proliferation of this technique would only make life easier for the baddies. You could argue that passphrases aren't even competing with randomly generated passwords but rather with the naive passwords that people come up with that has simple character substitution for special characters. However, this is the same reason why it should only be confined to use in places where a yubikey for active directory windows login or a password manager wouldn't be practical. If you're going to use a tool to generate your passphrase, why not use a tool to store it and retrieve it at will, while also protecting yourself from shoulder surfing?
wiml 6y ago
If they're "reaching into the edges of their vocabulary" they're doing it wrong anyway. People are terrible random number generators. Don't do that. Use an actual random number generator to select a sequence of words from a list.
- codetrotter 6y ago
  > Use an actual random number generator to select a sequence of words from a list I wrote a program to do this for me which I myself use, and anyone else is free to download and use it (open source, ISC license) :D It supports a few different options, including one that will tell you what the passphrase entropy would be. https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
jacoblambda 6y ago
This is something where there is value in having a generator to do the password creation. That way the use only needs to remember the phrase rather than also come up with it.

bradknowles 6y ago

With respect, maybe your vocabulary is 20,000 words, but I submit that the average English-only speaker is more like about 10,000 words. This is a case where I choose to believe xkcd unless and until you can provide convincing evidence otherwise.

maven29 6y ago
The total possible permutations of characters in just an alphanumeric 12 digit random password is 36¹², which is around 400 times larger than the number of permutations possible with 4 words picked out of a pool of 10,000 or 10000⁴. This might seem reasonable, however, this is only a false economy as people tend to gravitate towards common words that evoke simple concepts, which drastically reduces the search space. A dictionary attack isn't anything novel and the proliferation of this technique would only make life easier for the baddies. You could argue that passphrases aren't even competing with randomly generated passwords but rather with the naive passwords that people come up with that has simple character substitution for special characters. However, this is the same reason why it should only be confined to use in places where a yubikey for active directory windows login or a password manager wouldn't be practical. If you're going to use a tool to generate your passphrase, why not use a tool to store it and retrieve it at will, while also protecting yourself from shoulder surfing?

wiml 6y ago

If they're "reaching into the edges of their vocabulary" they're doing it wrong anyway. People are terrible random number generators. Don't do that. Use an actual random number generator to select a sequence of words from a list.

codetrotter 6y ago
> Use an actual random number generator to select a sequence of words from a list I wrote a program to do this for me which I myself use, and anyone else is free to download and use it (open source, ISC license) :D It supports a few different options, including one that will tell you what the passphrase entropy would be. https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen

jacoblambda 6y ago

This is something where there is value in having a generator to do the password creation. That way the use only needs to remember the phrase rather than also come up with it.