3 ms·

Your password doesn't have to be "6tFcVbNh^TfCvBn" but it can be something like "The quick fox jumps over the lazy brown dog." and still be strong with the adde

Your password doesn't have to be "6tFcVbNh^TfCvBn" but it can be something like "The quick fox jumps over the lazy brown dog." and still be strong with the added benefit that it's more memorable. Password-less authentication will be great once the machine can recognize my face and voice and know it's me.

DanBC 15y ago
> "The quick fox jumps over the lazy brown dog." I honestly can't tell if you're joking. Just in case you're not: that's a horribly insecure passphrase.
- larholm 15y ago
  That specific example might be flawed, but the principle is sound; a keyphrase is easy to remember and has plenty of entropy. "I used to smoke Kings cigarettes under the bridge" suits me a lot better than "3D5g!§x&".
  - FuzzyDunlop 15y ago
    http://arstechnica.com/business/news/2012/03/passphrases-only-marginally-more-secure-than-passwords-because-of-poor-choices.ars http://arstechnica.com/business/news/2012/03/passphrases-onl... It's sound if it's a phrase that is isn't common or well known.
    - larholm 15y ago
      We definitely agree there. Uncommon phrases are not that difficult to think of though; my own example is the only hit on google for that phrase.
- goatslacker 15y ago
  Not joking, but yes a horrible example that's already been pointed out.
perlgeek 15y ago
The problem is that you need the same number of bits of entropy. I estimate that "6tFcVbNh^TfCvBn" has about 90 bits of entropy. So if you want to come up with a pass phrase that's equally secure, it has to be just as hard to remember as that password, otherwise it can be brute forced more easily by somebody who knows you very well. So it could be 5 to 6 truly random words from a dictionary. But as soon as you come up with a phrase that's easier to remember than 5 or 6 truly random words, it becomes easier to attack again.

3 ms·

Your password doesn't have to be "6tFcVbNh^TfCvBn" but it can be something like "The quick fox jumps over the lazy brown dog." and still be strong with the adde

by goatslacker 15y ago

DanBC 15y ago
> "The quick fox jumps over the lazy brown dog." I honestly can't tell if you're joking. Just in case you're not: that's a horribly insecure passphrase.
- larholm 15y ago
  That specific example might be flawed, but the principle is sound; a keyphrase is easy to remember and has plenty of entropy. "I used to smoke Kings cigarettes under the bridge" suits me a lot better than "3D5g!§x&".
  - FuzzyDunlop 15y ago
    http://arstechnica.com/business/news/2012/03/passphrases-only-marginally-more-secure-than-passwords-because-of-poor-choices.ars http://arstechnica.com/business/news/2012/03/passphrases-onl... It's sound if it's a phrase that is isn't common or well known.
    - larholm 15y ago
      We definitely agree there. Uncommon phrases are not that difficult to think of though; my own example is the only hit on google for that phrase.
- goatslacker 15y ago
  Not joking, but yes a horrible example that's already been pointed out.
perlgeek 15y ago
The problem is that you need the same number of bits of entropy. I estimate that "6tFcVbNh^TfCvBn" has about 90 bits of entropy. So if you want to come up with a pass phrase that's equally secure, it has to be just as hard to remember as that password, otherwise it can be brute forced more easily by somebody who knows you very well. So it could be 5 to 6 truly random words from a dictionary. But as soon as you come up with a phrase that's easier to remember than 5 or 6 truly random words, it becomes easier to attack again.