3 ms·
My understanding is that diceware is no longer considered secure though. Aren't there wordlists that just consist of combining dictionary words, rendering dice
by Shared404 6y ago
My understanding is that diceware is no longer considered secure though.
Aren't there wordlists that just consist of combining dictionary words, rendering diceware more dangerous than a password manager?
- shakna 6y agoThere have always been dictionary attacks. You're judging it from the wrong position. Diceware is an improvement upon the usual kinds of passwords people feel forced to come up with, and then re-use everywhere. A password manager is better than diceware, and whilst it feels like less friction to people who use them, people can be unwilling to use one. Just rejecting passwords found in HIBP's stolen passwords list had me receive death threats and long rants about how password security isn't my responsibility and I was putting up too much friction.
- Shared404 6y agoAh, that makes sense. Thanks for clarifying for my slow self. Edit: Also > rejecting passwords found in HIBP's stolen passwords list had me receive death threats and long rants about how password security isn't my responsibility That is amazing in a horrifying sort of way. I'm sorry you went through that.
- surround 6y agoThe comic calculates entropy with the assumption that the attacker knows that your password is four common words. Even if they run a dictionary attack on your password, it will still be secure. Diceware passwords are still recommended by security experts over any other method. https://www.eff.org/dice https://www.eff.org/dice