Date: Sat, 9 Apr 2016 10:36:52 +0200 From: "e@...tmx.net" <e@...tmx.net> To: passwords@...ts.openwall.com Subject: Passphrases: syntax vs entropy On 04/09/2016 10:10 AM, Patrick Proniewski wrote: >>> it's quite clear that the structure of correct language makes >>> entropy plummet. >> no. absolutely not. >> it is not clear and it does not plummet at all. >> here are my calculations on the question >> arxiv.org/abs/1603.06133 >> it should be sufficient to make the phrase one word longer >> to overcome this entropy loss. > I trust you on the math here, but I'm skeptical about your hypothesis. > You take into account the full Oxford English Dictionary, > [but] a "real" dictionary is probably 3000 to 10000 words long. > > You state that W^8/7294 [...] is significantly greater than W^7, > but that's true only for W > 7294. > For most users, W might be lower than 7294 You forgot the premise. we are not talking about protecting every individual user, we are talking about the properties of the passwords! The question is: does this password creation scheme provide sufficient protection? Yes it does. Do exist a sufficiently stupid user capable of making mess of the proposed scheme. Yes it does! Actually FOR ANY TOOL there are sufficiently incompetent users capable of inflicting self injury. If you are dealing with a specific set of alternatively gifted users, then you can develop an alternative password creation scheme, for example you can choose their passwords, or otherwise assist them personally. > Attackers go for the low hanging fruits Yes! this is why i began with the password strength metric which specifically determine the height of each fruit! And no i did NOT claim that all passphrases are EQUALLY strong. -Eugene
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.