3 ms·
Looks like a good design Doing something like randomly sampling a range of a-zA-Z0-9 and all the symbols without order or structure is absolutely the worse way
by raverbashing 2y ago
Looks like a good design
Doing something like randomly sampling a range of a-zA-Z0-9 and all the symbols without order or structure is absolutely the worse way of doing it for passwords that humans need to type/read, or in fact anything that might get tripped by special characters (like shell scripts, etc)
Yes yes you might lose a bit of entropy, just add one or two characters to it and it will make up for it. Passwords are not so much bruteforced from zero anymore rather than leaked from places with bad password hashes
- tuxone 2y agoI just opened the Password app for the first time to look at the generator. It seems like the pattern is: [a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6} with exactly only one uppercase char and one digit. I don't want to do the maths but that looks like a lot of removed entropy.
- timabdulla 2y agoHe mentions the entropy in the article...
- Veliladon 2y ago*They just FYI.
- tuxone 2y agoRight, thanks. So from 160 bits down to 70 bits of entropy (there is also fancy syllables and bad words to take into account).
- eviks 2y agoQuite the opposite > these new passwords have 71 bits of entropy, up from the 69 from the previous format.
- tuxone 2y agoI am referring to the loss of entropy compared to a (theoretically) fully random 20-chars password.
- nneonneo 2y agoNit, 160 bits of entropy would be if you could get 8 bits per character, but that’s highly unrealistic. 6.0~6.3 bits is more feasible based on what most websites will tend to accept, which lands you at around 120-126 bits of entropy for a fully random password.
- deleted 2y ago[deleted]
- nneonneo 2y agoFully random: 62^18 in that format, or about 107 bits of entropy. Their approach: ~71 bits per the article (I counted ~73 bits but I’m not using their exact algorithm) I’d say it’s not too bad. With a good password hashing algorithm you’re looking at nearly 2^100 operations to bruteforce their passwords, which isn’t going to be feasible anytime soon. (Even with a crappy hash algorithm it’s still going to be over 2^80 operations). And, in this case, that entropy trade off means the passwords are easier to remember and type in, making it more likely for humans to actually use those passwords.