New NIST password guidelines: don't require character types or rotation

Re:New NIST password guidelines: don't require character typ... by lmm on Wednesday December 14, 2016 @11:53AM (#13177416)

> You're right, it's much better, but the entropy of an English word is nowhere near log2(20K) (between 14 and 15 bits of entropy), especially in a grammatically correct sentence, because you're simply unlikely to select them truly randomly.

I've heard the average entropy of English is 3 bits/character, in which case 14-15 bits sounds about right for a word.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by loup-vaillant on Wednesday December 14, 2016 @01:46PM (#13178536)

I'm not sure your average English word has as much as five characters on average. Okay, let's count this paragraph.

91 characters, in 21 words. 4.3 characters on average, which would mean 13 bits of entropy. I don't believe it. It sounds like your source didn't account for word frequencies in real sentences, let alone grammatical constraints.

[ Parent | on HN ]

Re:New NIST password guidelines: don't require character typ... by lmm on Wednesday December 28, 2016 @06:35AM (#13269886)

A single example coming up as 13 is not remotely enough justification to say 14-15 is wrong.

[ Parent | on HN ]