Comment on Security expert reveals surprising way to make your password stronger: use emojis
ammonium@lemmy.world 11 months agothesecurityfactory.be/password-cracking-speed/
8 character a-zA-Z is 45 bits of entropy (log2(56^8), about the same as the XKCD password if you take from a 2048 word list. That’s crackable in a minute on AWS.
Password hashes get frequently stolen, don’t rely on rate limiting if it’s something you really care about.
Here are the dice ware recommendations on the number of words: theworld.com/~reinhold/dicewarefaq.html#howlong
elbarto777@lemmy.world 11 months ago
Sure, but the average English speaker knows way more than 2048 words. Let’s not forget about case sensitivity, made-up or “inside joke” words, names, and specific industry vocabulary.
ammonium@lemmy.world 11 months ago
Even if you take four words of a 30000 word list (quick Google says that’s the number of words an average person knows), that’s still less bits of entropy than a 5 word diceware password (7776 word list). People are also really bad at randomness, so your own string of random words is likely going to be much worse.
elbarto777@lemmy.world 11 months ago
Thanks for the explanation. What’s diceware?
poopkins@lemmy.world 11 months ago
It’s the concept of literally using a die to choose with randomness (humans are terrible at trying to be random); a link with details is in a previous comment.
ammonium@lemmy.world 11 months ago
theworld.com/~reinhold/diceware.html