Hacker News new | past | comments | ask | show | jobs | submit login

Why are you comparing a 30 character word with a 6 word passphrase?

You need to look at bits of entropy.

A 6 word passphrase is about the same as a 12 character password if you use any printable ASCII character.




because entropy is directly related to the number of possible values and number of values in the password, which is what i am comparing

i then went on to establish those values as being only those in the english alphabet, 26 characters, stead your referenced ascii set or even the diceware character set which allows some special characters

then i took the minimum suggested diceware length of 6 words, rounded the average word length of 4.2 up to 5, which gives us 6*5=30 characters

so one diceware password example:

    affixafireafootagainagateagave
    
    can be seen as diceware would have it, 6 words of length 5:
      [affix, afire, afoot, again, agate, agave]
    or 30 individual characters:
      [a,f,f,i,x,a,f,i,r,e,a,f,o,o,t,a,g,a,i,n,a,g,a,t,e,a,g,a,v,e]
so utilising any underlying pattern, here only using the diceware wordset, weakens a passphrase of equal length

or if you want to abstract away from the actual values that you use to determine a passphrase's strength you could say: diceware lowers the entropy of an individually random value passphrase of equal length

but that phrase unecesarily contains verbage that can confuse whereas my previous comment showed all of the number possible permutations in such a way as to easily see that one is greater than the other making the guess space larger




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: