[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5708BF24.4060701@bestmx.net>
Date: Sat, 9 Apr 2016 10:36:52 +0200
From: "e@...tmx.net" <e@...tmx.net>
To: passwords@...ts.openwall.com
Subject: Passphrases: syntax vs entropy
On 04/09/2016 10:10 AM, Patrick Proniewski wrote:
>>> it's quite clear that the structure of correct language makes
>>> entropy plummet.
>> no. absolutely not.
>> it is not clear and it does not plummet at all.
>> here are my calculations on the question
>> arxiv.org/abs/1603.06133
>> it should be sufficient to make the phrase one word longer
>> to overcome this entropy loss.
> I trust you on the math here, but I'm skeptical about your hypothesis.
> You take into account the full Oxford English Dictionary,
> [but] a "real" dictionary is probably 3000 to 10000 words long.
>
> You state that W^8/7294 [...] is significantly greater than W^7,
> but that's true only for W > 7294.
> For most users, W might be lower than 7294
You forgot the premise. we are not talking about protecting every
individual user, we are talking about the properties of the passwords!
The question is: does this password creation scheme provide sufficient
protection? Yes it does.
Do exist a sufficiently stupid user capable of making mess of the
proposed scheme. Yes it does! Actually FOR ANY TOOL there are
sufficiently incompetent users capable of inflicting self injury.
If you are dealing with a specific set of alternatively gifted users,
then you can develop an alternative password creation scheme,
for example you can choose their passwords, or otherwise assist them
personally.
> Attackers go for the low hanging fruits
Yes! this is why i began with the password strength metric
which specifically determine the height of each fruit!
And no i did NOT claim that all passphrases are EQUALLY strong.
-Eugene
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
