Hacker News new | past | comments | ask | show | jobs | submit login

16 letters is ~75 bits of entopy (if they are randomly selected), not 65. The usual recommendation is 80, but it's not as bad as you say. I don't know how Keepass is doing its math, but 65 is wrong.



KeePass considers letter runs and common words to lower entropy. So “pass word pass word” fits the scheme above but demonstrates lower entropy.

The examples in their docs show that a run of characters “aaaa…” only has an estimate of 7 bits:

https://keepass.info/help/kb/pw_quality_est.html

Obviously the estimate is wrong when the password will always have a fixed length and a randomized character set. But KeePass doesn’t know that “pass word pass word” is following set rule. Perhaps parent commenter ran the calculation on an example with a run or common word within it.

You’re right it’s 75 bits for the format used by Google here.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: