Comment on Security expert reveals surprising way to make your password stronger: use emojis
ammonium@lemmy.world 1 year agothesecurityfactory.be/password-cracking-speed/
8 character a-zA-Z is 45 bits of entropy (log2(56^8), about the same as the XKCD password if you take from a 2048 word list. That’s crackable in a minute on AWS.
Password hashes get frequently stolen, don’t rely on rate limiting if it’s something you really care about.
Here are the dice ware recommendations on the number of words: theworld.com/~reinhold/dicewarefaq.html#howlong
elbarto777@lemmy.world 1 year ago
Sure, but the average English speaker knows way more than 2048 words. Let’s not forget about case sensitivity, made-up or “inside joke” words, names, and specific industry vocabulary.
ammonium@lemmy.world 1 year ago
Even if you take four words of a 30000 word list (quick Google says that’s the number of words an average person knows), that’s still less bits of entropy than a 5 word diceware password (7776 word list). People are also really bad at randomness, so your own string of random words is likely going to be much worse.
elbarto777@lemmy.world 1 year ago
Thanks for the explanation. What’s diceware?
poopkins@lemmy.world 1 year ago
It’s the concept of literally using a die to choose with randomness (humans are terrible at trying to be random); a link with details is in a previous comment.
ammonium@lemmy.world 1 year ago
theworld.com/~reinhold/diceware.html