Tag Info

New answers tagged

0

In both examples, it became significantly stronger. However, the original was almost assuredly strong enough And by adding the randomness you generally blow up the "easy to remember/type" value in the diceware/xkcd style password if you need more entropy,either add more words, or use a password manager with a completely gibberish password. Silverlight ...


1

Use enough entropy then there's nothing to worry about. For an 80 bit password just choose 8 random words. Using your correct $58j#O1, battery staple technique with CSPRNG, assuming your password section is over the full character range (96 chars) then you have 10 bits + 6.5 * 7 + 10 + 10 = 75.5 bits. These are both under the assumption the attacker ...


5

Any question about password entropy needs to start with a discussion of what "password entropy" really means, and what kind of attack you are trying to protect yourself from. In a nutshell, password entropy is an estimate of how many incorrect guesses an attacker will have to make before they stumble onto your password. These estimates are based on standard ...


2

Since you have specifically asked about entropy, I'll start by covering the objective aspects of your question. The entropy is reduced, because you are taking away half the keyspace from each side. To simplify this, if the entropy of a 10 character password with lowercase and uppercase characters is log2(52^10) = ~ 57 bits of entropy then you remove the ...


-1

No it doesn't "significantly reduce the practical security" of the password. Password is an "all or none" puzzle. The attacker doesn't know Char sets of each side of the password. So entropy is even useless here. Length is what matters (which in turn would affect entropy the most, anyway). If an attacker doesn't have that in the Dictionary he's using, he's ...


1

Yes demonstration for a 15 char password (value are aproximate): first password: entropy= log2(90)*15 = 100 15 char in a charset of 90 second password : entropy = log2(90/2)*15+4 =89 15 char take in a charset of 90/2 and hold shift after character N (N between 1 and 15 then entropy = 4) time to break p1 = time to break p2* 2^(100-89) your modified ...


1

there isn't fiable entropy calculation for password determined without true random process we can calculate entropy of random generated method : choose 5 words in a set of 1024 ( by piece roll) entropy : 5*log2(1024) = 50 for every part which doesn't use random generation we can only calculate entropy when following a specific method. entropy estimation ...


6

Once you say the magic words "targeted attack", I'm not sure that theory has much to say on the topic. The whole idea of password entropy only makes sense against a generic dictionary / rainbow table attack. Basically, the online entropy estimators are trying to estimate how far an attacker will have to delve into their rainbow table before they find your ...


1

Definitely not impossible, and you will not lose entropy by repeating seed data, but you will not gain any either. By "they", I am just referring to a fictional person that is trying to figure out how your entropy is generated. If they know that you are rolling a dice, they know each digit will be 1-6. If they know how many times you are rolling the dice, ...



Top 50 recent answers are included