Re:Late Meditations on XKCD 936
by arielweisberg on Saturday February 01, 2014 @05:15PM
(#7163707)
I think it is cool that both estimates of entropy come to the same number, but that still seems like the wrong way to look at the approach even if Randall didn't intend it that way.
The NIST entropy estimation is based off of characters that aren't chosen at random (I think?) and it is a heuristic.
For the approach I think Randall intended to describe they aren't really words, just glyphs chosen randomly from a set of glyphs. That these glyphs are easy to memorize and drop right into existing password interfaces is orthogonal.
Re:Late Meditations on XKCD 936
by maxerickson on Saturday February 01, 2014 @04:51PM
(#7163586)
There's a little box for each bit of entropy (this is consistent throughout the comic). There are 11 little boxes by each word.
First character is 4 bits: c = 4
The next 7 chars are 2 bits/each: "orrect " = 14
Characters 9-20 are 1.5 bit/each: "horse batter" = 18
Charactes 21-n are 1 bit/each: "y staple" = 8
No bonus for including both upper and non-alpha chars.
No bonus for passwords of length less than 20 chars, not containing dictionary words, because the password is longer than 20 characters.
Total entropy: 4 + 14 + 18 + 8 = 44 bits of entropy.