Password entropy in layman's terms

Question

Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is and how it's calculated) in terms a layman can understand?

Answer 1

Not sure can it be of any help to you, but once I managed to describe entropy to a child.

After I said that entropy is a measure of chaos in system (to a group of people), a 12 (year more or less) year old said he doesn't understand me. I replied with - "Well, when your room is untidy, entropy is high. But when you clean your room, entropy is low - everything is in order then. So, when a thief comes to your room trying to steal your homework, when the room is clean and entropy is low, he will easly find it - it's usually on your desk or in your school bag. On the other hand, when your room is untidy and your homework is somewhere laying around, thief doesn't know exactly where it is and it can't find it quickly. If entropy is high enough (let's say roof collapse), it's almost impossible to find a piece of paper in it.

High entropy - finding a needle in a haystack.

In the game - Guess who I am, at the begging entropy is very high, but after few questions entropy is lower and lower until someone has enough information to guess who the person is (or in security, after trails (and errors) and trials, to guess what is the password).

Answer 2

I would skip the idea of entropy entirely and just talk about how hard it would be to guess the password. Basically, tell him that password entropy is a measure of about how many passwords a person would have to guess before they hit on yours.

A password like "password" or "123456" would practically be someone's first guess. A password like "6love" might be in their first few thousand guesses. A password like "1974!jhT" would take billions of guesses.

Answer 3

For a password, "entropy" is related to "guessability". Low entropy is easier to guess, high entropy is harder to guess.

The primary aspect is randomness. A non-random password, like "secret", is easily guessed. A random password, like "8jh$#F" is harder to guess.

Length plays a part, too. "secret of a lifetime man" is not much more random than "secret", but the additional length means it is harder for a brute-force attack to crack, and therefore it has better "entropy".

So, to a layman: A good password has high entropy, which means it is hard to guess, uses multiple character types (upper-lower-number-symbol), and the longer the better.

Answer 4

The layman's part comes later, but first, let's get scientific.

I struggled to understand the concept of mathematical entropy, but, lucky for me, I work with an engineer. When I asked him to explain it, he directed me towards the graphs of two laws: uniform distribution and normal distribution.

Knowing the Y-axis describes a measurement of probability of guessing the password, and X-axis describes a value of what the password is... in a uniform distribution (see diagram), the entropy is high, because no matter what the password is, the probability of guessing it is the same value (statically the same chance). In a normal distribution (see diagram), the probability of guessing the password changes... for instance, you're ~70% likely to be able to guess the password (sort of).

For the layman.... Where's Waldo/Wally?

High entropy:

• You're trying to find Waldo by identifying what he's wearing.
• You are given 100 people.
• 100 of these people are dressed like Waldo, including Waldo.
• Where is Waldo?

∴ You have a very little chance of identifying Waldo.

Low entropy:

• You're trying to find Waldo by identifying what he's wearing.
• You are given 100 people.
• 33 of these people are dressed like Mark, 33 are dressed like John, 33 are are dressed like Tom, and 1 is dressed like Waldo (and is Waldo).
• Where is Waldo?

∴ You have a very high chance of identifying Waldo.