News for hackers. Stuff that matters.
Re:I hate password rules by genewitch on Wednesday November 17, 2021 @11:40AM (#29255318)
So "fishyidea" has less or equal entropy to "262119"?
Re:I hate password rules by thefifthsetpin on Wednesday November 17, 2021 @12:51PM (#29256345)
Neither fishyidea nor 262119 show up in haveibeenpwned's database, so they're at least uncommon. Neither of them look to have much entropy, though.

2x211y doesn't look very random to me. 2 and 1 are consecutive, and there are only 4 distinct digits here. Even if it was randomly generated, a good password generator would probably discard it for being akin to passwords that humans tend to generate. (This is especially true when you impose minimum lengths to passwords. "26219 isn't long enough? Fine. 262119.")

Fish and idea are both among the top few thousand most common words. Searching adjective+noun pairs is going to be much more fruitful than searching arbitrary word pairs, and ideas can in fact be fishy, so it makes sense to guess that particular adjective+noun pair before trying metamorphicidea.

Re:I hate password rules by kazinator on Wednesday November 17, 2021 @02:08PM (#29257443)
I would say it has better entropy, but not by much.

The word "idea" appears list of 850 common words:

https://en.wiktionary.org/wiki/Appendix:Basic_English_word_l...

"fish" is ranked #1453 in the list of lemmas linked from here:

https://en.wiktionary.org/wiki/Wiktionary:Frequency_lists#To...

We can arithmetically encode the choice of two words from dictionaries of 1000 and 1500, respectively, using 21 bits.

The two bits estimate is a somewhat pessimistic lower bound.