3 ms·

The problem is that as soon as passphrases are common, it isn't 80 bits anymore, it's however many words you choose. It just becomes a slightly harder dictionar

• deathanatos 3y ago
  …no? If you follow the scheme the person is suggesting, 80 bits of entropy is 80 bits, and it will take 80 bits "worth" of brute-force searching to crack a passphrase during such a search. If you're literally choosing "correct-horse-battery-staple", yeah, it's just a slightly harder dictionary attack, but that's not the suggestion being made, and that's not different than choosing hunter2 as a password.
• infogulch 3y ago
  Calculating bits of entropy of a passphrase with an equation for the bits of a random password is dumb. I'm calculating like log2((64k word dictionary size) ^ 5) = 80 bits. https://www.wolframalpha.com/input?i=log2%28%2864000%29+%5E+5%29 https://www.wolframalpha.com/input?i=log2%28%2864000%29+%5E+... I guarantee 5 words will be easier to remember than the 14 random characters required to get equal entropy from a random password from a dictionary of 58 characters. https://www.wolframalpha.com/input?i=solve+for+x+log2%28%2858%29+%5E+x%29+%3D+80 https://www.wolframalpha.com/input?i=solve+for+x+log2%28%285...
• numpad0 3y ago
  The idea of "Correct Horse Battery Staple" password is it should take a sufficiently hard dictionary attack, like 2k candidates ^ 4 choices ~= 44 bits. You could do eight words random out of 2k dictionary and that's 87 bits in theory.