Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Once hackers realise people are using ~4 random words for a password the entropy will decrease hugely.


I think you've got it backwards: the entropy calculation here assumes that the attacker already knows the scheme. The 2^44 possible passwords are therefore a lower boundary for the entropy.

In practice the attacker must cast a wider net because he doesn't know exactly which word list you use, or if you are using a completely different password scheme. This increases the difficulty.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: