[<prev] [next>] [day] [month] [year] [list]
Message-Id: <21571487-58C6-4D0C-898C-11E7398EE734@patpro.net>
Date: Sat, 9 Apr 2016 12:10:03 +0200
From: Patrick Proniewski <patpro@...pro.net>
To: passwords@...ts.openwall.com
Subject: Re: Password creation policies
(reposting my direct reply to the list so the thread is complete)
Hi Eugene,
On 08 avr. 2016, at 23:57, e@...tmx.net wrote:
>> it's quite clear that the structure of correct language makes entropy > plummet.
>
> no. absolutely not.
> it is not clear and it does not plummet at all.
>
> here are my calculations on the question
> arxiv.org/abs/1603.06133
>
> it is conclusive that the grammar correctness adds very little predictability; it should be sufficient to make the phrase one word longer to overcome this entropy loss.
I trust you on the math here, but I'm skeptical about your hypothesis. You take into account the full Oxford English Dictionary, including obsolete words. That's fine if you want to compute the full key space but it does not account on the true active vocabulary of password users.
Attackers go for the low hanging fruits, users are lazy: both converge to a "real" dictionary that is probably 3000 to 10000 words long.
You state that W^8/7294 [...] is significantly greater than W^7, but that's true only for W > 7294. For most users, W might be lower than 7294
But well, it does not really change the outcome as 0.35^n is not related to W. Your paper is pretty convincing!
thanks,
patpro
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
