10 ms·
Basing passphrases off of a (since you've just mentioned it on Hacker News) well-known public source is usually a bad idea. Why not just pick random words (usin
by garrettr_ 12y ago
Basing passphrases off of a (since you've just mentioned it on Hacker News) well-known public source is usually a bad idea. Why not just pick random words (using a CSPRNG like /dev/urandom) from a dictionary? This is the "Diceware" approach, which is recommended because it is simple to implement and has straightforward provable security guarantees.
- EGreg 12y agoWe do have a mode where the software generates random phrases like "the [noun] [verb] the [noun]" generating about a million possible combinations (100 x 100 x 100) But the space of three consecutive words in Yahoo News is even larger, and frankly, most passwords are chosen from a small space anyway. And finally, the examples are just meant to inspire, so people don't select "password" as their password.