Comment on Security expert reveals surprising way to make your password stronger: use emojis

• ammonium@lemmy.world ⁨11⁩ ⁨months⁩ ago

  thesecurityfactory.be/password-cracking-speed/

  8 character a-zA-Z is 45 bits of entropy (log2(56^8), about the same as the XKCD password if you take from a 2048 word list. That’s crackable in a minute on AWS.

  Password hashes get frequently stolen, don’t rely on rate limiting if it’s something you really care about.

  Here are the dice ware recommendations on the number of words: theworld.com/~reinhold/dicewarefaq.html#howlong

  source

  • elbarto777@lemmy.world ⁨11⁩ ⁨months⁩ ago

    Sure, but the average English speaker knows way more than 2048 words. Let’s not forget about case sensitivity, made-up or “inside joke” words, names, and specific industry vocabulary.

    source

    • ammonium@lemmy.world ⁨11⁩ ⁨months⁩ ago

      Even if you take four words of a 30000 word list (quick Google says that’s the number of words an average person knows), that’s still less bits of entropy than a 5 word diceware password (7776 word list). People are also really bad at randomness, so your own string of random words is likely going to be much worse.

      source

      • elbarto777@lemmy.world ⁨11⁩ ⁨months⁩ ago

        Thanks for the explanation. What’s diceware?

        source

        • -> View More Comments