2 ms·

I made this a while back. :) http://rmmh.github.io/abbrase/ http://rmmh.github.io/abbrase/ An interesting fork: http://bcaller.github.io/abbrase/ http://bcalle

I made this a while back. :) http://rmmh.github.io/abbrase/ http://rmmh.github.io/abbrase/ An interesting fork: http://bcaller.github.io/abbrase/ http://bcaller.github.io/abbrase/ Some comments: https://news.ycombinator.com/item?id=8059210 https://news.ycombinator.com/item?id=8059210 Letting users pick their passphrases from a list sacrifices a few bits of entropy in theory, and in practice gives much more usable mnemonics. I'm not sure grammatical models are a definite improvement over Abbrase's naive bigram method -- part-of-speech constraints can make sentences more awkward than freeform associations. Having 128 bit passwords feels like overkill. I'm not sure on the precise threat model for sites, but the worst case of someone getting your password hash should be ameliorated by not reusing passwords between sites and the password being stretched properly. If you're actually deriving encryption keys directly from passwords, you'll probably be okay with 60 bits of password entropy and 30 bits of memory-hard stretching.

e12e 12y ago
Interesting. I should add, that my idea was to publish an RFC-style standard that worked both ways (from the password to number and back again) -- which is why mapping two letters to 256 bits was nice: it makes for short word lists. It might even, with some care, allow for localizing the actual word list to at least some other European languages (we're really only concerned with the two first letters). > Having 128 bit passwords feels like overkill. I agree. However, as a user can't be sure sites properly stretch passwords, I'd say 64-bits feels more comfortable. For use-cases where one are protecting keys, it'd be good if the password wasn't the weakest brute-force target with too large a margin. Obviously, if you can manage to get 64-bits into a password suitable for everyday use, chaining two together for the (presumably rarer case of) master passwords should be viable. But even 64 bits is a lot of entropy to be typing in, no matter how you encode it :-/

e12e 12y ago

Interesting. I should add, that my idea was to publish an RFC-style standard that worked both ways (from the password to number and back again) -- which is why mapping two letters to 256 bits was nice: it makes for short word lists. It might even, with some care, allow for localizing the actual word list to at least some other European languages (we're really only concerned with the two first letters). > Having 128 bit passwords feels like overkill. I agree. However, as a user can't be sure sites properly stretch passwords, I'd say 64-bits feels more comfortable. For use-cases where one are protecting keys, it'd be good if the password wasn't the weakest brute-force target with too large a margin. Obviously, if you can manage to get 64-bits into a password suitable for everyday use, chaining two together for the (presumably rarer case of) master passwords should be viable. But even 64 bits is a lot of entropy to be typing in, no matter how you encode it :-/