3 ms·
I am not a cryptographer, but I'll offer some advice, if I may: don't let people choose a passphrase, generate one for them. People are very bad at creating goo
by eliteraspberrie 12y ago
I am not a cryptographer, but I'll offer some advice, if I may: don't let people choose a passphrase, generate one for them. People are very bad at creating good passphrases, but decent at memorizing a good one.
I say that because I don't trust the zxcvbn library. It underestimates the entropy of "aaaaa" as 7 bits [log(26 * 5)], not the correct value of 23 bits [log(26) * 5], for example. In this instance, it's to your advantage, but it doesn't inspire confidence in its other calculations.
- lolbrainwallets 12y agozxcvbn has problems but your example is backwards. "aaaaa" gets (as it should) low entropy because it is a single repeated character. It is more likely to be used than "rqntd". The major limitations are that it is worthless for estimating entropy of passphrase (which is what it's being used for here) and words not in its dictionary (non english).
- eliteraspberrie 12y agoMy mistake, zxcvbn uses that formula only for repetitions.
- deleted 12y ago[deleted]