Password Entropy Debate
Discussions focus on the security and entropy of passphrases using dictionary words versus random character strings, including vulnerabilities to dictionary attacks, brute-force feasibility, and memorability trade-offs.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Perhaps some sort of correlation to password strength for dictionary type attacks
No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.
Almost certainly not, since this would reduce the entropy of their passwords, making brute forcing easier.
The best human rememberable password is 4-5 words from a dictionary + a special character. Assuming that most people have roughly 20k words vocabulary and that most keyboards can type easily say 60 characters, you get 20,000^460 or 9.610^18 passwords. This means that if you were to crack at a rate of one billion (with a b) passwords per second (unrealistic) you would still take on average of 9,000 years or 18,000 years maximum.
How this affects popular premise that a passphrase is much better than a password?
This misses the point. The comic assumes a dictionary attack - that is to say, not brute-forcing character-by-character but rather word-by-word, whether this is constructed in advance in a static dictionary (possible, for 4 words from 1000; less possible for larger) or generated in a stream (likely more efficient regardless). Cryptographically, it's a dictionary attack - you're confining your search space based on guesses (in this case, we're assuming entirely accurate guesses) about the shape
The password space is big. They could release trillions.
Would you consider very long passwords (say 40 characters) containing only dictionary words to be safe?
That seems unlikely for a high entropy password.
AFAIK:Correct Horse Battery Staple is good! The main benefit is that with this scheme, it’s much much easier for a human to memorize, compared to a random string.A random string is still secure, given that it has enough entropy. I would say a length of ~15 characters or more is desired (A-Z + a-z + 0-9, maybe some periods and hyphens etc.) Unfortunately, this is also quite hard to memorize.Both these are very hard to crack! Especially if the cracker can’t do it offline. (Because online,