3 ms·
A random 4-word passphrase is more than enough to stop online attacks against high-value targets (e.g. bank accounts) that have any throttling at all. A random
by nknight 15y ago
A random 4-word passphrase is more than enough to stop online attacks against high-value targets (e.g. bank accounts) that have any throttling at all.
A random 5-word passphrase with three random characters tossed at the end has better than 82 bits of entropy and will halt offline attacks, at least by non-TLAs, for many years to come.
These are not hard to memorize. What's hard to memorize is 101 different passphrases, many of which you don't use every day, which is why the people actively working to make it easier are focusing on the management problem.
- drostie 15y agoJust to give people a flavor, here is a script I wrote in Python to generate various random passwords: http://www.bpaste.net/show/24775/ http://www.bpaste.net/show/24775/ What it looks like in practice: drostie@signy:~$ words -c 5 4 (Line entropy: 64.7055497954 bits.) rebelliousness subpoenas garrulous coach mono peroxide underused fathers entreat entwined meatier umbilicuses relay torrential husband Jenkins Kristine sluggers feverishly Lessie So each of those lines has a little over 64 bits of entropy. You might also consider the following one-liner in the shell: drostie@signy:~$ head -c 9 /dev/urandom | base64 ST2QpSb0eKHk If you're not paranoid, consider typing "password" into DuckDuckGo and it will give you a random password. If you're slightly more paranoid, consider using mouse-movements to generate your own random password with a random tool I coded for making random API keys: http://code.drostie.org/api.html http://code.drostie.org/api.html . Just truncate to the first 10-12 characters or so.