Password Entropy Debate

Discussions focus on the security and entropy of passphrases using dictionary words versus random character strings, including vulnerabilities to dictionary attacks, brute-force feasibility, and memorability trade-offs.

📉 Falling 0.2x Security
5,718
Comments
20
Years Active
5
Top Authors
#1535
Topic ID

Activity Over Time

2007
9
2008
28
2009
80
2010
178
2011
407
2012
481
2013
556
2014
357
2015
339
2016
519
2017
435
2018
329
2019
362
2020
257
2021
260
2022
415
2023
349
2024
231
2025
119
2026
7

Keywords

AFAIK TL CPU IMO MD5 PKCS DR combos.txt GPU password passwords dictionary entropy characters brute words character brute force random

Sample Comments

gao8a Nov 15, 2020 View on HN

Perhaps some sort of correlation to password strength for dictionary type attacks

bnegreve Aug 11, 2011 View on HN

No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.

rmc Feb 6, 2013 View on HN

Almost certainly not, since this would reduce the entropy of their passwords, making brute forcing easier.

x0054 Sep 14, 2013 View on HN

The best human rememberable password is 4-5 words from a dictionary + a special character. Assuming that most people have roughly 20k words vocabulary and that most keyboards can type easily say 60 characters, you get 20,000^460 or 9.610^18 passwords. This means that if you were to crack at a rate of one billion (with a b) passwords per second (unrealistic) you would still take on average of 9,000 years or 18,000 years maximum.

daemon13 Aug 27, 2013 View on HN

How this affects popular premise that a passphrase is much better than a password?

dllthomas Apr 15, 2013 View on HN

This misses the point. The comic assumes a dictionary attack - that is to say, not brute-forcing character-by-character but rather word-by-word, whether this is constructed in advance in a static dictionary (possible, for 4 words from 1000; less possible for larger) or generated in a stream (likely more efficient regardless). Cryptographically, it's a dictionary attack - you're confining your search space based on guesses (in this case, we're assuming entirely accurate guesses) about the shape

ludamad Jun 16, 2016 View on HN

The password space is big. They could release trillions.

bitbear Jun 26, 2011 View on HN

Would you consider very long passwords (say 40 characters) containing only dictionary words to be safe?

anyfoo Nov 10, 2022 View on HN

That seems unlikely for a high entropy password.

cpach Feb 6, 2024 View on HN

AFAIK:Correct Horse Battery Staple is good! The main benefit is that with this scheme, it’s much much easier for a human to memorize, compared to a random string.A random string is still secure, given that it has enough entropy. I would say a length of ~15 characters or more is desired (A-Z + a-z + 0-9, maybe some periods and hyphens etc.) Unfortunately, this is also quite hard to memorize.Both these are very hard to crack! Especially if the cracker can’t do it offline. (Because online,