3 ms·

I've tested the passphrase: password password password password and most of the online entropy checkers[1] says it's really safe to use such .. is this tr

by _lce0 12y ago

I've tested the passphrase: password password password password and most of the online entropy checkers[1] says it's really safe to use such .. is this true? 1. http://rumkin.com/tools/password/passchk.php http://rumkin.com/tools/password/passchk.php

fweespeech 12y ago
http://www.oxforddictionaries.com/us/words/the-oec-facts-about-the-language http://www.oxforddictionaries.com/us/words/the-oec-facts-abo... Well assuming random guessing with 95% vocabulary coverage its about 50,000 words. A passphrase checker that doesn't start from there but rather works from the ascii tokens is likely not very helpful for checking the strength of a passphrase. > ... should be 8 characters or longer, which forces you to use multiple words or extra symbols. > ... should have upper case, lower case, symbols, and numbers; or at least three of those four groups. > ... should not be a common word and should not be a common phrase. > ... should not contain a date, a name, or other things that can be associated with you. > ... should be created randomly or semi-randomly. > ... should not be a suggestion when you type in the first few characters into Google. As for your cited tester, you seem to have ignored every single piece of advice on the page and it seems it doesn't test for it in an automated way. I'd say, in this case, the problem is a bug in the tester rather than the truth of that being "safe". If you had followed the guidelines, yes, it'd likely be reasonably safe.
jmcphers 12y ago
The entropy checker doesn't know about externalities like how common a word is or how likely it is to appear following some other word or how frequently it's used in passwords specifically. It's just measuring the length of the string, and probably the class from which its characters are drawn (in your case lowercase letters and spaces). Relevant Dilbert: http://dilbert.com/strip/2001-10-25 http://dilbert.com/strip/2001-10-25
- _lce0 12y ago
  my point was using some common word on purpose, expecting it to produce a low entropy result My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go" .. which, apparently, is not
  - TheLoneWolfling 12y ago
    The problem is that it depends on your definition of the sample space. In particular if the sample space remains constant. If your sample space is "all words in the english language, capitalized and uncapitalized", then the second one has more entropy than the first one. But if your sample space is "all characters or runs of characters that appear in the passphrase", the second one has a whole lot less entropy.
  - Dove 12y ago
    An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die rolls. This is a false assumption unless, of course, those decisions actually were die rolls. It's generally going to tell you passwords are stronger than they are -- sometimes a LOT stronger. A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password would be if it were a random string. Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written. So don't trust the results too much. What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself? That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.
garrettr_ 12y ago
Entropy checkers are based on a faulty premise and are always at a disadvantage compared to the state of the art in password cracking. Online security would be in a better place if they had never been invented at all. The only way to guarantee the entropy of a passphrase is to generate it from a source of high quality randomness (e.g. a CSPRNG or by actually rolling dice, hence the name "Diceware"). Diceware-style passphrases simply balance this requirement with usability by optimizing for things humans are typically good at memorizing (strings of words).

by _lce0 12y ago

fweespeech 12y ago

http://www.oxforddictionaries.com/us/words/the-oec-facts-about-the-language http://www.oxforddictionaries.com/us/words/the-oec-facts-abo... Well assuming random guessing with 95% vocabulary coverage its about 50,000 words. A passphrase checker that doesn't start from there but rather works from the ascii tokens is likely not very helpful for checking the strength of a passphrase. > ... should be 8 characters or longer, which forces you to use multiple words or extra symbols. > ... should have upper case, lower case, symbols, and numbers; or at least three of those four groups. > ... should not be a common word and should not be a common phrase. > ... should not contain a date, a name, or other things that can be associated with you. > ... should be created randomly or semi-randomly. > ... should not be a suggestion when you type in the first few characters into Google. As for your cited tester, you seem to have ignored every single piece of advice on the page and it seems it doesn't test for it in an automated way. I'd say, in this case, the problem is a bug in the tester rather than the truth of that being "safe". If you had followed the guidelines, yes, it'd likely be reasonably safe.

jmcphers 12y ago

The entropy checker doesn't know about externalities like how common a word is or how likely it is to appear following some other word or how frequently it's used in passwords specifically. It's just measuring the length of the string, and probably the class from which its characters are drawn (in your case lowercase letters and spaces). Relevant Dilbert: http://dilbert.com/strip/2001-10-25 http://dilbert.com/strip/2001-10-25

_lce0 12y ago
my point was using some common word on purpose, expecting it to produce a low entropy result My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go" .. which, apparently, is not
- TheLoneWolfling 12y ago
  The problem is that it depends on your definition of the sample space. In particular if the sample space remains constant. If your sample space is "all words in the english language, capitalized and uncapitalized", then the second one has more entropy than the first one. But if your sample space is "all characters or runs of characters that appear in the passphrase", the second one has a whole lot less entropy.
- Dove 12y ago
  An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die rolls. This is a false assumption unless, of course, those decisions actually were die rolls. It's generally going to tell you passwords are stronger than they are -- sometimes a LOT stronger. A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password would be if it were a random string. Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written. So don't trust the results too much. What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself? That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.

garrettr_ 12y ago

Entropy checkers are based on a faulty premise and are always at a disadvantage compared to the state of the art in password cracking. Online security would be in a better place if they had never been invented at all. The only way to guarantee the entropy of a passphrase is to generate it from a source of high quality randomness (e.g. a CSPRNG or by actually rolling dice, hence the name "Diceware"). Diceware-style passphrases simply balance this requirement with usability by optimizing for things humans are typically good at memorizing (strings of words).