Re:Passphrases You Can Memorize That Even the NSA Can’t Guess
by abandonliberty on Friday March 27, 2015 @07:58PM
(#9279826)
We should be able to at least estimate an upper bound.
If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words and arrive at 100B combinations.
Optimistically we're at 37 bits, not even a 7 character [a-zA-Z0-9!@#$%^&()].
And unlike the [a-zA-Z0-9!@#$%^&*()], we could madly cut that down based on frequency and popularity.
Therefore existing phrase passwords are security through minority. If they are adopted, they provide at best an order of magnitude or two over simple dictionary words.
But we're kidding ourselves, most people still use 'password'.
If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words and arrive at 100B combinations.
Optimistically we're at 37 bits, not even a 7 character [a-zA-Z0-9!@#$%^&()].
And unlike the [a-zA-Z0-9!@#$%^&*()], we could madly cut that down based on frequency and popularity.
Therefore existing phrase passwords are security through minority. If they are adopted, they provide at best an order of magnitude or two over simple dictionary words.
But we're kidding ourselves, most people still use 'password'.