3 ms·

It removes you from the list of people who get pwned with a rainbow table from leaked passwords, but that's not much security. English has only got ~1.2 bits o

It removes you from the list of people who get pwned with a rainbow table from leaked passwords, but that's not much security. English has only got ~1.2 bits of entropy per character. [1] [1] Table 1 in https://arxiv.org/pdf/1808.04444.pdf https://arxiv.org/pdf/1808.04444.pdf

ravi-delia 6y ago
I was going to snarkily make a point about that figure only making sense in the context of grammatical english text, with the example of a randomly chosen 7 letter word being one of 32,909 options. log(32,909) is about 15. Which is of course 1.5 bits per character, and that's generously assuming that a person will actually randomly pick from all those potential options. So sorry for what I almost commented, but now I have to wonder why the entropy of a word on its own is so close to the entropy of a word in a sentence. Am I missing something? Is it just coincidence?
- deleted 6y ago
  [deleted]
schoen 6y ago
But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical English text that occurs in a communicative setting. That means that before you get there, you probably already know what word goes at the end of this sentence. You can measure this with human native speakers, or with a compression algorithm, or with a naive letter n-gram or word n-gram model, and get different statistics -- each of which is correct in the sense of each model's uncertainty about how the text continues. In the password setting, words can be used in all sorts of ways, some of which are very unpredictable to an attacker, so it's plausible that each word adds at least log₂(len(dictionary)) to the password entropy when it's chosen at random from a dictionary, even when the attacker expects that the password selection method could have used that dictionary.
- deleted 6y ago
  [deleted]

ravi-delia 6y ago

I was going to snarkily make a point about that figure only making sense in the context of grammatical english text, with the example of a randomly chosen 7 letter word being one of 32,909 options. log(32,909) is about 15. Which is of course 1.5 bits per character, and that's generously assuming that a person will actually randomly pick from all those potential options. So sorry for what I almost commented, but now I have to wonder why the entropy of a word on its own is so close to the entropy of a word in a sentence. Am I missing something? Is it just coincidence?

deleted 6y ago
[deleted]

schoen 6y ago

But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical English text that occurs in a communicative setting. That means that before you get there, you probably already know what word goes at the end of this sentence. You can measure this with human native speakers, or with a compression algorithm, or with a naive letter n-gram or word n-gram model, and get different statistics -- each of which is correct in the sense of each model's uncertainty about how the text continues. In the password setting, words can be used in all sorts of ways, some of which are very unpredictable to an attacker, so it's plausible that each word adds at least log₂(len(dictionary)) to the password entropy when it's chosen at random from a dictionary, even when the attacker expects that the password selection method could have used that dictionary.

deleted 6y ago
[deleted]