Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations for some common cases and hardware. The tool is available here.

As has been said over and over again, these strength & recovery calculations are averages, and only apply if the words are chosen at random. The tool offers 2 options for random choices. The online mode uses http://www.random.org. Offline mode uses the Excel RND function. I have 2 questions.

Commenters state that "Entropy is a property of the generation process". I agree that it is not (only) a property of the passphrase. But isn't strength (entropy) above all, a property of the combination of passphrase and recovery process?

The random choice option in the tool is a 2 step process when using the Internet as a source. The first step gets random (dictionary word) numbers from the Internet. To make the final pass-phrase choice less NSA-able, the dictionary sequence is randomized before words are picked from the dictionary by their random word number from step 1.

For sure the first step delivers a random choice. But is the final choice still a random choice when I randomized the dictionary before choosing? (using a local random pseudo generator)

share|improve this question
    
Every non-dictionary password is good. There exist much faster way to get inside then to crack passwords :) –  Jiri Xichtkniha Oct 8 '13 at 12:36
    
Don't agree or recommend that to access password vaults for example. And how do you know your password is not in a 1.5 billion long 'dictionary'? By using a passphrase! –  Dick99999 Oct 8 '13 at 14:58
    
My comment was about that too complicated passwords make people not to remember them and write them down on a paper closed to computer :) This is reality. Way forward is to use dual-factor authentication (something you know, something you have). –  Jiri Xichtkniha Oct 9 '13 at 8:25
    
What about apps that use a (derived) password as an encryption key, like a password vault. 2-factor authentication is fine to protect regular access to the vault. But if the encrypted vault is stolen, you still depend on the passphrase only, don't you? –  Dick99999 Oct 10 '13 at 11:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.