2 ms·

Cleverness can't compete with real entropy. There's a reason that ping-pong balls, and not mathematicians, generate the weekly lottery numbers. Say there are a

by sowbug 4y ago

Cleverness can't compete with real entropy. There's a reason that ping-pong balls, and not mathematicians, generate the weekly lottery numbers. Say there are a million cool math phrases, and for each one, a million different l33tspeak ways of expressing it. That's 10^12 possibilities, or around 2^40, which was coincidentally the US export limit for encryption tools in the 1990s (i.e., weak then and much weaker 30 years later). Maybe that doesn't sound horrible to you, but what are the chances that your scheme is so weird that a dictionary builder wouldn't generate it? Better to stick with the xkcd/diceware/BIP-39 family of methods. Those algorithms intentionally lack cleverness.

ravi-delia 4y ago
I mean 40 bits is better than a correct-horse-battery-staple format password by a little bit. The space of all interesting equations is presumably tiny, but I do think I could memorize a random twenty-expression password almost as well as I could remember 6 or 7 words (since many random arrangements will be somewhat meaningful). I'll stick with my 5 random words because they're easy to type, but so long as you draw at random it really doesn't matter what you're sampling from.
- sowbug 4y ago
  "presumably tiny" That's right. My million-x-million estimate was rhetorically generous. (xkcd's specific example was about 44 bits.) OP -- not to put too fine a point on it, but it's a terrible idea. So much money has been lost to brain wallets in the digital-currency space by people who picked obscure song lyrics, wrote it backward in pig latin, capitalized every third letter etc. etc. etc. and then wondered why their balances were zeroed out. You want the competition to be about the limits of physics, not about the limits of your creativity vs. an army of computers. Read Moonwalking with Einstein by Joshua Foer to see how easy it is to memorize things using the memory-palace technique (https://en.wikipedia.org/wiki/Method_of_loci https://en.wikipedia.org/wiki/Method_of_loci). Anyone can remember a 10-word phrase, especially if you build it up by adding a word or two every few weeks. The key is to start with something unguessable, as ravi-delia says, like https://iancoleman.io/bip39/ https://iancoleman.io/bip39/. If you start with something guessable like a transliterated math expression, then you brought a knife to a gun fight.
  - ravi-delia 4y ago
    Oh yeah rereading it's clear they meant specific equations, not just using Latex expressions as the corpus

by sowbug 4y ago

ravi-delia 4y ago

I mean 40 bits is better than a correct-horse-battery-staple format password by a little bit. The space of all interesting equations is presumably tiny, but I do think I could memorize a random twenty-expression password almost as well as I could remember 6 or 7 words (since many random arrangements will be somewhat meaningful). I'll stick with my 5 random words because they're easy to type, but so long as you draw at random it really doesn't matter what you're sampling from.

sowbug 4y ago
"presumably tiny" That's right. My million-x-million estimate was rhetorically generous. (xkcd's specific example was about 44 bits.) OP -- not to put too fine a point on it, but it's a terrible idea. So much money has been lost to brain wallets in the digital-currency space by people who picked obscure song lyrics, wrote it backward in pig latin, capitalized every third letter etc. etc. etc. and then wondered why their balances were zeroed out. You want the competition to be about the limits of physics, not about the limits of your creativity vs. an army of computers. Read Moonwalking with Einstein by Joshua Foer to see how easy it is to memorize things using the memory-palace technique (https://en.wikipedia.org/wiki/Method_of_loci https://en.wikipedia.org/wiki/Method_of_loci). Anyone can remember a 10-word phrase, especially if you build it up by adding a word or two every few weeks. The key is to start with something unguessable, as ravi-delia says, like https://iancoleman.io/bip39/ https://iancoleman.io/bip39/. If you start with something guessable like a transliterated math expression, then you brought a knife to a gun fight.
- ravi-delia 4y ago
  Oh yeah rereading it's clear they meant specific equations, not just using Latex expressions as the corpus