That only works if someone already has access to a system’s password database.
Comment on Security expert reveals surprising way to make your password stronger: use emojis
ammonium@lemmy.world 11 months agoFour words is too low these days to protect against gpu bruteforcing
lolcatnip@reddthat.com 11 months ago
elbarto777@lemmy.world 11 months ago
Got a source on that?
ammonium@lemmy.world 11 months ago
thesecurityfactory.be/password-cracking-speed/
8 character a-zA-Z is 45 bits of entropy (log2(56^8), about the same as the XKCD password if you take from a 2048 word list. That’s crackable in a minute on AWS.
Password hashes get frequently stolen, don’t rely on rate limiting if it’s something you really care about.
Here are the dice ware recommendations on the number of words: theworld.com/~reinhold/dicewarefaq.html#howlong
elbarto777@lemmy.world 11 months ago
Sure, but the average English speaker knows way more than 2048 words. Let’s not forget about case sensitivity, made-up or “inside joke” words, names, and specific industry vocabulary.
ammonium@lemmy.world 11 months ago
Even if you take four words of a 30000 word list (quick Google says that’s the number of words an average person knows), that’s still less bits of entropy than a 5 word diceware password (7776 word list). People are also really bad at randomness, so your own string of random words is likely going to be much worse.