4 ms·
Except when people create phrases like that they aren't choosing random words from a dictionary, they're most likely choosing words from their own vocabulary wh
by quinnchr 13y ago
Except when people create phrases like that they aren't choosing random words from a dictionary, they're most likely choosing words from their own vocabulary which will be significantly less than 100k words. Additionally the distribution is not uniform, reducing entropy even further.
- belorn 13y agoEvery password require that the user choose randomly. Words, letters, numbers, pixels on a screen... All require randomness in choosing. This is why some websites assign passwords to users and do not allow users to pick their own custom passwords. The only safe passwords are those generated by machines. This does not mean that picking words to form a pass-phrase is less secure than picking letters to form a password.
- quinnchr 13y agoI don't see what's wrong with my argument that choosing a pass phrase will have less entropy... Does less entropy not mean less secure? Or am I just reasoning about the entropy all wrong?
- stonemetal 13y agoLess entropy means less secure. However the method in the comic is not pick a passphrase. It is pick 4 random words(hopefully with the help of a computer with a good source of randomness, so they are really random). This is because phrases have semantic meaning and reduced entropy. Also people tend to pick phrases that are common enough to be found on the internet somewhere like movie quotes, book quotes and thus are likely to be in an attackers dictionary. So four random words not a phrase has better entropy than a passphrase, and is less likely to appear in a dictionary attack than a phrase.
- caf 13y agoRight - this is the crucial point. The method suggested in the XKCD comic isn't to pick four words yourself out of your head - it's to randomly select four words from a dictionary.
- fnordfnordfnord 13y agoTheir own vocabulary may contain words that are not in the dictionary, such as slang, intentional or accidental misspellings, etc.
- quinnchr 13y agoYes this is true. This is why password crackers will scrape twitter/facebook/whatever for modern slang, common mispellings, neolgisms, etc for their word lists.