News for hackers. Stuff that matters.
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by jmcphers on Friday March 27, 2015 @12:42PM (#9277368)
The entropy checker doesn't know about externalities like how common a word is or how likely it is to appear following some other word or how frequently it's used in passwords specifically. It's just measuring the length of the string, and probably the class from which its characters are drawn (in your case lowercase letters and spaces).

Relevant Dilbert:

http://dilbert.com/strip/2001-10-25

Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by _lce0 on Friday March 27, 2015 @12:46PM (#9277393)
my point was using some common word on purpose, expecting it to produce a low entropy result

My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go"

.. which, apparently, is not

Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by Dove on Friday March 27, 2015 @01:22PM (#9277689)
An online entropy checker is going to assume all the decisions that went into making the password, beyond the ones it's been programmed to understand, were die rolls. This is a false assumption unless, of course, those decisions actually were die rolls. It's generally going to tell you passwords are stronger than they are -- sometimes a LOT stronger.

A password from the space of "things users think up while staring at a dialog box for 5 seconds" has a much different probability distribution than "random strings". There are common passwords, and that's an exploitable pattern, but recognizing those patterns is difficult. All the typical entropy checker is going to tell you is how strong the password would be if it were a random string.

Any pattern is, in principle, exploitable. If I use ten digits of pi as a password, a programmed entropy checker isn't going to know that's easier to guess than ten random digits unless it has been told that, and including all possible exploitable patterns would require rather better software than can currently be written.

So don't trust the results too much.

What you really want to know with passwords is, "Is there outside information that would make this easy to guess?" Does it conform to some external, independent pattern, or are all the patterns in it things you made up after seeing the password itself?

That is why I am a big advocate of random generation as the only safe way to make passwords. Knowing the strength of a password is the same thing as knowing the size of the class of live probabilities from which it's drawn, and to do that you have to characterize the method used for generating it.

Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by TheLoneWolfling on Friday March 27, 2015 @01:18PM (#9277654)
The problem is that it depends on your definition of the sample space. In particular if the sample space remains constant.

If your sample space is "all words in the english language, capitalized and uncapitalized", then the second one has more entropy than the first one. But if your sample space is "all characters or runs of characters that appear in the passphrase", the second one has a whole lot less entropy.