4 ms·
How many words is that passphrase actually choosing from? Maybe 200? Three of them are "and", "the" and "I" which would probably be among the top 10 words used
by gregwebs 4y ago
How many words is that passphrase actually choosing from? Maybe 200? Three of them are "and", "the" and "I" which would probably be among the top 10 words used in a pass phrase.
In practice, pass phrases probably work well right now because they aren't used much, but if they were more commonly used and thus specifically attacked against, you would need passphrase strength rules.
A rule I use is to include a word that is not in a standard dictionary.
- snet0 4y agoJust to mention, 200 choose 8 is roughly 10e14. If you could assuming 3 of the words are "and", "the" and "I", you limit the other word selection to 200 choose 5 ~= 10e10. Add an extra order of 4-5 for word order, and it's not like this is a small solution space.
- gregwebs 4y agoBut a randomly generated 9 character password is still stronger. There is a big over-confidence in pass phrases. As pointed out by other comments there is a predictible ordering to words in a passphrase. If you slip up like the parent commenter you end up with something that is actually weak. Pass phrases need rules (like requiring a non-dicitionary word).