Re:Master password in Firefox or Thunderbird? Do not bother
by Dylan16807 on Sunday March 11, 2018 @03:20AM
(#16562030)
If we take the post at face value, it's strong overkill. Face value means that "46 characters from the full set" is even vaguely descriptive of the password.
Sure, perhaps it's just a phrase or something, but once you start calling part of a post a lie where do you stop? I'd rather not get into such a mess.
Re:Master password in Firefox or Thunderbird? Do not bother
by Buge on Sunday March 11, 2018 @03:37AM
(#16562069)
I never said any part of the post was a lie. Most people's passwords are not random. The word "password" doesn't mean random. So there isn't a reason to assume that the password is random. xkcd's recommended password is 25 characters, and 44 bits of entropy. Extrapolating that out would mean a 46 character password would be 81 bits of entropy.
Yes, "from the full set" likely means that it's higher than 1.46 bits/character. But it doesn't mean it's much more.
Re:Master password in Firefox or Thunderbird? Do not bother
by stouset on Sunday March 11, 2018 @05:02AM
(#16562261)
At the point where someone has a 46-character password consisting of uppercase, lowercase, digits, and symbols that takes a week to memorize, I think it’s a fair guess that it’s random.
The average password isn’t random. But GP was not describing anything remotely close to an average password in the first place.
Turns out (according to GP) it isn’t random. But I stand by my point that it was a reasonable assumption given the available data.
No it's not. User-chosen data is rarely random, so it's safe to say that Santosh83's password is not random. This article claims English has 1.46 bits of entropy per character[1]. If Santosh83's password is regular English, then it would have ~105 bits of entropy.
>Even just twenty characters is within spitting distance of 2^128
Someone[2] sent bitcoins to a brainwallet secured only by the phrase "it was the best of times" (24 characters). The bitcoins were stolen in 4 seconds. 20 characters is not enough. You need to do actual entropy analysis. And don't use quotes from anywhere. Crackers crawl the internet and build databases of all the quotes they find online. This tends to include book quotes, movie quotes, etc.
[1] https://www.gwern.net/docs/statistics/1996-teahan.pdf
[2] https://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_b...