3 ms·
Note that bruce schneirer said not to do it, so people don't. nobody's proved it wrong, but BS said not to, so people avoid it.
by anonbanker 12y ago
Note that bruce schneirer said not to do it, so people don't.
nobody's proved it wrong, but BS said not to, so people avoid it.
- Dylan16807 12y agoPeople are really bad at estimating password security, which is why he advised against it as a trick. You're right that he shouldn't have advised against it on a basic entropy level... except that 44 bits is not enough. Using words is okay, but you have to impress on people two critical things. 1. random words. not sentences. use a program or dice. 2. Each word is only as good as two random characters. 8 words is as good as 16 characters, no more. People try to get 'clever' and it never works out well.