5 ms·
This comes up a lot in the bitcoin world where people think it is neat that they could use a pass phrase as their private key to their wallet. It's actually in
by epscylonb 14y ago
This comes up a lot in the bitcoin world where people think it is neat that they could use a pass phrase as their private key to their wallet.
It's actually incredibly dumb, if the attacker knows you are using a pass phrase then a dictionary attack is about as effective as a brute force attack. And in the case of bitcoin wallets, even a pass phrase with 12 dictionary words has substantially less entropy than a random key.
You could of course use 3 instead of e and do other unusual things, but all that stuff reduces the memorability of the phrase while gaining you less than you think in terms of entropy.
If you want entropy in your passwords or phrases, and you do even if you don't realise it, then you need them to be random.
User friendly key management is the real problem in online security, something that is secure and simple enough for the average senior to understand and use could make a ton of money.
- jamoes 14y ago>even a pass phrase with 12 dictionary words has substantially less entropy than a random key Actually, 12 random dictionary words is incredibly secure. If you choose 12 random words from a pool of 100k words, then your entropy is: 100000^12 == 10^60 =~ 2^200 In other words, 200 bits of entropy. It would take an attacker longer than the history of the history of Earth just to count to 2^200. So, even if an attacker knew that your password was 12 random english words, they're never gonna crack it using brute force.