5 ms·
> introduce some random numbers or special characters into the words, it's still easy to remember and type If you ask users to do so themselves they tend to do
by nullc 2y ago
> introduce some random numbers or special characters into the words, it's still easy to remember and type
If you ask users to do so themselves they tend to do so in extremely predictable ways that add l1ttle entropy!
If you do it automatically and in a way that has high entropy the result is a lot less memorable.
Probably just adding an additional word adds more entropy at less memorability cost.
- thesuitonym 2y ago>If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
- nullc 2y agoAttackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.