3 ms·

Of course the human brain routinely stores memories which are vastly larger than 56 bits. The trick is in mapping those to passwords. For instance, if you went

Of course the human brain routinely stores memories which are vastly larger than 56 bits. The trick is in mapping those to passwords. For instance, if you went to grade school in the US I claim you can easily remember the following password: ipattfotusoaattrfwisonugiwlajfa. ("I pledge allegiance to the flag...") Song lyrics tend to work particularly well.

WhitneyLand 12y ago
This is an insecure approach. Dictionary style attacks now can account for phrases from vast libraries of literature, pop culture, or anything else you're likely to remember.
- indubitably 12y ago
  But the suggestion is to carry out a simple hash on the input phrase — one could use the second or third letter, for instance. (Or the first, second, third, first, second, third…) How could a dictionary-style attack predict all possible such arrangments?
  - WhitneyLand 12y ago
    Why not? The only limit on password cracking techniques is combinatorial complexity. This gives an overview: http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
- jorgis 12y ago
  But do they take into account obscure maintenance manuals for foreign cars?
mixedbit 12y ago
A question is how much entropy a string like this has? Say you have 10 million English songs, if you always start a password with the first letter from a song, and choose the password to have between 20-30 letters, you only have about 26 bits of entropy in the password, which is trivial to brute force. You can increase the entropy by starting from a different word, or inserting random characters, but the entropy will never be close to the entropy of a random string of the same length.
Terr_ 12y ago
> Of course the human brain routinely stores memories which are vastly larger than 56 bits. Usually because they are LOW-entropy. Spelling rules, grammar rules, rhymes, shared culture, all of those things erode any utility they may have had as random or unpredictable.

WhitneyLand 12y ago

This is an insecure approach. Dictionary style attacks now can account for phrases from vast libraries of literature, pop culture, or anything else you're likely to remember.

indubitably 12y ago
But the suggestion is to carry out a simple hash on the input phrase — one could use the second or third letter, for instance. (Or the first, second, third, first, second, third…) How could a dictionary-style attack predict all possible such arrangments?
- WhitneyLand 12y ago
  Why not? The only limit on password cracking techniques is combinatorial complexity. This gives an overview: http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/ http://arstechnica.com/security/2013/10/how-the-bible-and-yo...
jorgis 12y ago
But do they take into account obscure maintenance manuals for foreign cars?

mixedbit 12y ago

A question is how much entropy a string like this has? Say you have 10 million English songs, if you always start a password with the first letter from a song, and choose the password to have between 20-30 letters, you only have about 26 bits of entropy in the password, which is trivial to brute force. You can increase the entropy by starting from a different word, or inserting random characters, but the entropy will never be close to the entropy of a random string of the same length.

Terr_ 12y ago

> Of course the human brain routinely stores memories which are vastly larger than 56 bits. Usually because they are LOW-entropy. Spelling rules, grammar rules, rhymes, shared culture, all of those things erode any utility they may have had as random or unpredictable.