News for hackers. Stuff that matters.

A comment on Late Meditations on XKCD 936. Parent comment

Re:Late Meditations on XKCD 936 by leephillips on Saturday February 01, 2014 @03:31PM (#7163260)
Can anyone explain to me why he assings only 2^11 bits of entropy to a word? Doesn't that correspond to choosing from only about 2000 words? If we choose from the more typical adult vocabulary of 100,000 words, isn't that log2(100,000) = 17 bits? Or am I doing it wrong?
[ Parent | on HN ]
Re:Late Meditations on XKCD 936 by bredman on Saturday February 01, 2014 @03:35PM (#7163287)
I think he did this to show how even with a very restricted dictionary you could still build a relatively secure login system. Having a restricted dictionary could also help with the issues other people are discussing with humans being socially programmed to select certain word orders as their password under this scheme.
[ Parent | on HN ]
Re:Late Meditations on XKCD 936 by maxerickson on Saturday February 01, 2014 @03:52PM (#7163354)
Typical vocabulary is smaller than that.

And pass phrases will tend away from words like perspicacious.

[ Parent | on HN ]
Re:Late Meditations on XKCD 936 by jimminy on Saturday February 01, 2014 @03:40PM (#7163306)
He's not assigning entropy per word. He's using NIST SP 800-63, based on the character-length of the phrase, to assign the entropy value.

Proof: https://news.ycombinator.com/item?id=7163362

[ Parent | on HN ]