4 ms·

> since typing in passwords is tedious i think passphrases are better for any situation where you might be typing them in multiple times a day. since you can

> since typing in passwords is tedious i think passphrases are better for any situation where you might be typing them in multiple times a day. since you can use all lowercase letters, it makes it much quicker than having to press the shift key for capitals or symbols, and you can make up for the lack of those characters by using a longer words/passphrase https://www.useapassphrase.com https://www.useapassphrase.com on top of that i usually spend a bit of time choosing words that are quicker to type. like words that have letters that alternative between each hand seem to be quicker than typing a word that's only on one side of the keyboard. avoiding words that have double letters for the same reason. making sure the end of one word and the start of the next are typed with different hands. choosing words where most of the letters go in the direction of your pinky to your index finger if possible

teddyh 5y ago
This is a whole other topic, but if you are choosing what words to use, the words are no longer random, and your password (sorry, “passphrase”) is no longer as secure as mere word counts might lead you to believe. If you insist on choosing words, you must compensate for this by choosing more words; i.e. having a longer passphrase. Exactly how many bits of entropy you lose by manually choosing words is hard to say without knowing your exact criteria for choosing, but it can be calculated exactly if these are known.
- 10000truths 5y ago
  Pick 5 random words from the top 10,000 most common English words, and you have just a bit more entropy than a password composed of 8 random printable ASCII characters.
  - teddyh 5y ago
    https://xkcd.com/936/ https://xkcd.com/936/
  - dredmorbius 5y ago
    Let a machine, or dice, do that for you and avoid common pitfalls. https://pypi.org/project/xkcdpass/ https://pypi.org/project/xkcdpass/ https://www.eff.org/dice https://www.eff.org/dice
- totetsu 5y ago
  Is there a brute force list out there that tires all the words (from diceware lists) that people are more likely to choose, and in the orders that they would choose them, etc, first? Its does seem very hard to quantify how much you lose by cycling through passphrases until you get one that feels like you could remember it. Personally I just make very long passphrases, and memorize them to tunes of songs. Its good typing practice everytime I boot up. Three times wrong and you have to restart.
  - deleted 5y ago
    [deleted]
- mackrevinack 5y ago
  yea that's definitely something to keep in mind. i usually try to use a few different word generators and also throw in a random character somewhere or spell a word in my own way just to make it a bit less predictable
- dredmorbius 5y ago
  We're already at the point where any phrase from any book ever written is probably insufficiently secure. (Mixing phrases from multiple books might work.) We've got a few parameters to work from here: - By a Google Books estimate from some years back, there were roughly 140 million books ever published. That's been going up by ~1--5 million a year for the past decade or so (only about 300k are "traditionally" published). See Bowker. - If we limit ourselves to a reasonable canon -- the 100, or 1,000, or 10,000 most-frequently-read books, that number goes down a lot. (Twenty years ago when I had this conversation at work with a user, I said "a phrase from Alice in Wonderland isn't obscure enough. They'd chosen lines from "Jabberwocky", and no I'd not run a cracker.) - A typical book runs about 250 pages, at about 500 words per page, and about 10 words per sentence. That's about 125,000 words, or 12,500 sentences, per book. Even assuming no sentence ever repeats (they do), that's "only" about 1.7 billion sentences in all published books. For the top 10k, it's only 125 million, the top thousand and 100 are 12.5 and 1.3 million respectively. Computationally and cryptographically, those are small keyspaces. Oh: and many of those books are scanned and OCRed. ZLibrary (from which LibGen and other sources pull) has over 8 million books (http://zlibraryexau2g3p.onion/ http://zlibraryexau2g3p.onion/) --- approaching that of a substantial university library collection (The University of California library system has 40.8 million print volumes across 10 campuses and 100 libraries, with 4.3 million digitised in HathiTrust: https://libraries.universityofcalifornia.edu/about/facts-and-figures https://libraries.universityofcalifornia.edu/about/facts-and...). Randomly-gathered words (EFF Diceware or xcdpass, see https://www.eff.org/dice https://www.eff.org/dice or https://pypi.org/project/xkcdpass/ https://pypi.org/project/xkcdpass/) are robust --- we don't just combine words at random typically. And as mentioned, joining phrases from different books should be reasonably memorable (combinatorics work in the defender's favour).

teddyh 5y ago

This is a whole other topic, but if you are choosing what words to use, the words are no longer random, and your password (sorry, “passphrase”) is no longer as secure as mere word counts might lead you to believe. If you insist on choosing words, you must compensate for this by choosing more words; i.e. having a longer passphrase. Exactly how many bits of entropy you lose by manually choosing words is hard to say without knowing your exact criteria for choosing, but it can be calculated exactly if these are known.

10000truths 5y ago
Pick 5 random words from the top 10,000 most common English words, and you have just a bit more entropy than a password composed of 8 random printable ASCII characters.
- teddyh 5y ago
  https://xkcd.com/936/ https://xkcd.com/936/
- dredmorbius 5y ago
  Let a machine, or dice, do that for you and avoid common pitfalls. https://pypi.org/project/xkcdpass/ https://pypi.org/project/xkcdpass/ https://www.eff.org/dice https://www.eff.org/dice
totetsu 5y ago
Is there a brute force list out there that tires all the words (from diceware lists) that people are more likely to choose, and in the orders that they would choose them, etc, first? Its does seem very hard to quantify how much you lose by cycling through passphrases until you get one that feels like you could remember it. Personally I just make very long passphrases, and memorize them to tunes of songs. Its good typing practice everytime I boot up. Three times wrong and you have to restart.
- deleted 5y ago
  [deleted]
mackrevinack 5y ago
yea that's definitely something to keep in mind. i usually try to use a few different word generators and also throw in a random character somewhere or spell a word in my own way just to make it a bit less predictable
dredmorbius 5y ago
We're already at the point where any phrase from any book ever written is probably insufficiently secure. (Mixing phrases from multiple books might work.) We've got a few parameters to work from here: - By a Google Books estimate from some years back, there were roughly 140 million books ever published. That's been going up by ~1--5 million a year for the past decade or so (only about 300k are "traditionally" published). See Bowker. - If we limit ourselves to a reasonable canon -- the 100, or 1,000, or 10,000 most-frequently-read books, that number goes down a lot. (Twenty years ago when I had this conversation at work with a user, I said "a phrase from Alice in Wonderland isn't obscure enough. They'd chosen lines from "Jabberwocky", and no I'd not run a cracker.) - A typical book runs about 250 pages, at about 500 words per page, and about 10 words per sentence. That's about 125,000 words, or 12,500 sentences, per book. Even assuming no sentence ever repeats (they do), that's "only" about 1.7 billion sentences in all published books. For the top 10k, it's only 125 million, the top thousand and 100 are 12.5 and 1.3 million respectively. Computationally and cryptographically, those are small keyspaces. Oh: and many of those books are scanned and OCRed. ZLibrary (from which LibGen and other sources pull) has over 8 million books (http://zlibraryexau2g3p.onion/ http://zlibraryexau2g3p.onion/) --- approaching that of a substantial university library collection (The University of California library system has 40.8 million print volumes across 10 campuses and 100 libraries, with 4.3 million digitised in HathiTrust: https://libraries.universityofcalifornia.edu/about/facts-and-figures https://libraries.universityofcalifornia.edu/about/facts-and...). Randomly-gathered words (EFF Diceware or xcdpass, see https://www.eff.org/dice https://www.eff.org/dice or https://pypi.org/project/xkcdpass/ https://pypi.org/project/xkcdpass/) are robust --- we don't just combine words at random typically. And as mentioned, joining phrases from different books should be reasonably memorable (combinatorics work in the defender's favour).