4 ms·
Just as a note, the http://xkcd.com/936/ http://xkcd.com/936/ password scheme has issues. See the discussion in the comments here: https://www.schneier.com/blog
by kerkeslager 13y ago
Just as a note, the http://xkcd.com/936/ http://xkcd.com/936/ password scheme has issues. See the discussion in the comments here: https://www.schneier.com/blog/archives/2012/09/recent_developm_1.html https://www.schneier.com/blog/archives/2012/09/recent_develo...
- zokier 13y agoI don't see any valid issues raised in that discussion beyond the question if 44ish bits of entropy is enough. And it is quite easy to bump the complexity if necessary. Wordlist of 10000 words (instead of 2000) and 5 (instead of 4) words and you get 66 bits of entropy (log2(10000^5)), which should be enough for most uses. edit: some numbers for scale: oclHashCat claims 2500M tries per second for plain SHA1 with single HD7970 GPU. That would mean that 4 of 2000 word passphrase would be cracked in 1.5 hours and 5 of 10000 word passphrase would take 1268 years.