3 ms·
Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better exampl
by teddyh 3y ago
Your example is misleading; “touch-some-grass” is hardly random. “horse-battery-staple-correct" is presumably randomly chosen, and is therefore a better example phrase.
- cubefox 3y agoI'm not sure how safe this is against dictionary attacks. And it's still not overly easy to remember.
- ndriscoll 3y agoIt's 100% safe from dictionary attacks. You can even make it grammatically correct. Just choose something like adjective-noun-adverb-transitive_verb-adjective-noun. If you choose each of six words randomly from a list of the 2k most common words with that part of speech, you get 66 bits of entropy, which is slightly more entropy than a random 11 character alphanumeric password with upper and lower case, but vastly easier to remember, type, and say out loud if you need to tell someone. Think of the words as just a view/rendering of a random bit string. You generate random numbers and then use that to index into your word lists to display those numbers. If you use an injective function for your view, you can choose it to have whatever "nice" (for humans) properties you want (e.g. grammatical validity), and no entropy will be lost (or gained).
- gostsamo 3y agoYep, lazy example, but even grammatically correct sentences are a lot. The idea though is for the passphrase to be something invoking a distinct image for the owner and I'm coming from a vacation. :)
- teddyh 3y agoYes, it’s all fine if it is actually randomly chosen, with enough bits: <https://news.ycombinator.com/item?id=14970652 https://news.ycombinator.com/item?id=14970652>