4 ms·

Most people have a limited vocabulary, in the order of 14 bits. They don't know how to come up with three random words either. That means < 52 bits, probably a

by tgv 5y ago

Most people have a limited vocabulary, in the order of 14 bits. They don't know how to come up with three random words either. That means < 52 bits, probably a lot less. So, these people would need a password generator. Which makes the point moot. Edit: 3*14 = 42, not 52...

DicIfTEx 5y ago
The final section of the article about ‘password diversity’[0] is interesting to me; allow me to think aloud for a little bit. Whilst I appreciate the recent shift to advising passphrases (and password managers, but that's a different topic) for normal users, the I've noticed that received wisdom tends to be that the words need to be unrelated, i.e. don't use a quote from a book (although I notice that the NCSC's own guidance[1] does not state this). However, surely this would be an acceptable workaround for those who would struggle to remember (or, as you say, conjure up) an assortment of random, sufficiently-complex words? Password diversity would be enhanced if the text-based authentication ecosystem included traditional passwords, random passphrases AND semantically-meaningful sentences, more so than with only the first two? Of course, quotations have their own strength problems (i.e., in a language like English any sentence will contain a lot of 1–3-letter words), and perhaps ‘it was the best of times it was the worst of times’ would just become the new ‘123456’, but perhaps the ecosystem-wide strengthening effect could mitigate those? [0] https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-random-words#section_4 https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-ran... [1] https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email https://www.ncsc.gov.uk/collection/top-tips-for-staying-secu...
- tgv 5y ago
  How many users actually read? I don't trust the surveys on this, at all. But if they've read a book, many a passphrase will be "you're a wizard", or some other YA cliche. In book quotes, there will be extremely little diversity. And nobody is going to type 'it was ...', as long as 'hunter1234' suffices. I don't think this is a problem with an easy solution. The low hanging fruit, enforced password rules, has been tried, further strengthening requires alternative solutions, such as 2FA, hardware keys, one-time pads, etc.
- DicIfTEx 5y ago
  Expanding on this, is it possible to quantify the effect on entropy of the words in a passphrase being semantically related rather than randomly-chosen? Without being a cryptographer/statistician, my gut feeling is it would involve Markov chains somehow.
pedrocr 5y ago
Is 16k really a limited vocabulary? The only reference I found online had that as the amount of vocabulary for the highest levels of language proficiency.
- tgv 5y ago
  16k is indeed pushing it, certainly w.r.t. generation (they'll recognize around 16k words, but won't be able to use them). And because they're never going to recall truly random words, there'll be 30 bits or less in the final passphrase. Just in case: correct, horse, staple, battery are far more frequent, and acquired earlier in life, and thus more likely to be part of a passphrase than e.g. rime, bagnio, pungently, cruse.
hiccuphippo 5y ago
Person, woman, man, camera, TV.

by tgv 5y ago

DicIfTEx 5y ago

The final section of the article about ‘password diversity’[0] is interesting to me; allow me to think aloud for a little bit. Whilst I appreciate the recent shift to advising passphrases (and password managers, but that's a different topic) for normal users, the I've noticed that received wisdom tends to be that the words need to be unrelated, i.e. don't use a quote from a book (although I notice that the NCSC's own guidance[1] does not state this). However, surely this would be an acceptable workaround for those who would struggle to remember (or, as you say, conjure up) an assortment of random, sufficiently-complex words? Password diversity would be enhanced if the text-based authentication ecosystem included traditional passwords, random passphrases AND semantically-meaningful sentences, more so than with only the first two? Of course, quotations have their own strength problems (i.e., in a language like English any sentence will contain a lot of 1–3-letter words), and perhaps ‘it was the best of times it was the worst of times’ would just become the new ‘123456’, but perhaps the ecosystem-wide strengthening effect could mitigate those? [0] https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-random-words#section_4 https://www.ncsc.gov.uk/blog-post/the-logic-behind-three-ran... [1] https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email https://www.ncsc.gov.uk/collection/top-tips-for-staying-secu...

tgv 5y ago
How many users actually read? I don't trust the surveys on this, at all. But if they've read a book, many a passphrase will be "you're a wizard", or some other YA cliche. In book quotes, there will be extremely little diversity. And nobody is going to type 'it was ...', as long as 'hunter1234' suffices. I don't think this is a problem with an easy solution. The low hanging fruit, enforced password rules, has been tried, further strengthening requires alternative solutions, such as 2FA, hardware keys, one-time pads, etc.
DicIfTEx 5y ago
Expanding on this, is it possible to quantify the effect on entropy of the words in a passphrase being semantically related rather than randomly-chosen? Without being a cryptographer/statistician, my gut feeling is it would involve Markov chains somehow.

pedrocr 5y ago

Is 16k really a limited vocabulary? The only reference I found online had that as the amount of vocabulary for the highest levels of language proficiency.

tgv 5y ago
16k is indeed pushing it, certainly w.r.t. generation (they'll recognize around 16k words, but won't be able to use them). And because they're never going to recall truly random words, there'll be 30 bits or less in the final passphrase. Just in case: correct, horse, staple, battery are far more frequent, and acquired earlier in life, and thus more likely to be part of a passphrase than e.g. rime, bagnio, pungently, cruse.

hiccuphippo 5y ago

Person, woman, man, camera, TV.