3 ms·
https://secure.wikimedia.org/wikipedia/en/wiki/Diceware https://secure.wikimedia.org/wikipedia/en/wiki/Diceware Properly executed, this will protect you agains
by burgerbrain 15y ago
https://secure.wikimedia.org/wikipedia/en/wiki/Diceware https://secure.wikimedia.org/wikipedia/en/wiki/Diceware
Properly executed, this will protect you against brute force attacks. No need to do nonsense like adding more spaces.
Of course XKCD botched it and said an inadequate minimum length...
Notable quote from the article: "This level of unpredictability assumes that a potential attacker knows both that Diceware has been used to generate the passphrase, the particular word list used, and exactly how many words make up the passphrase."
- darklajid 15y agoWas just about to quote that to you. Don't you think that you should take this quote into account when you say xkcd botched it?
- burgerbrain 15y agoThat's not how people in crypto roll :) He calculated the entropy assuming that knowledge was had, I think he botched it in saying that 44 bits were enough. Of course if he were to recalculate it without those assumptions, but make it clear that he were doing that, then it would be better.
- ordinary 15y agoEven 4 words is good enough for many use cases.
- burgerbrain 15y agoBest to error on the side of suggesting more. If the reader is technical enough to to realize you did that, then they're technical enough to estimate a more suitable value themselves.
- Tharkun 15y agoHere's how I use diceware: 1) throw single die to determine number of languages 2) throw dice to determine which languages (number of iterations depends on the result of #1) 3) throw dice to determine language 4) throw all dice to determine first word in language 5) repeat #3, #4 until you've reached the desired number of words