Tag Info

New answers tagged

0

You forget the most important thing, now that we know the password it's strength is effectively zero and will now be included in most dictionary's.


-1

It depends on the parameters of what you like. Say you prefer a password that you can type on your mobile device without switching keyboards. You can compute the entropy of passwords composed of only the characters on your main keyboard. If what you like is more subjective, the question becomes much harder to answer.


0

I believe the randomness would be reduced to lean to the human intuition that makes the password you chose "better". Linguistic, phonetic, logical, and other patterns can be used to seed such an attack dictionary. If a dictionary can be created, then it's not "perfect entropy", so choosing a password will reduce it somewhat.. but given the constraint of 8 ...


1

Your assumption is reasonable. If we repeatedly generate truely random passwords and pick the one we like most then a good assumption is that it is the simplest among the generated list. For simplicity of the argument, let us assume that the passwords are numbers between 1 and N, inclusive, with small numbers being "simpler", that is: the attacker will ...


3

In order for user rejection of specific random word selections to have an meaningful impact on passphrase security those rejections would need to be predictable. Otherwise there's no way for an attacker to eliminate certain words or word pairings and save time in their attempts to guess the passphrase, which is the primary way this practice would benefit ...


5

Your rejection/acceptance of a truly randomly generated password, and how many times you reject until you accept, will not affect the entropy as the entropy is determined in isolation from generation to generation (just like each toss of a coin doesn't affect the entropy of the next toss). All strings have the same entropy, it's only the context of ...


1

I think the most important component to trying to analyze this quantitatively is "a "strength meter" such as zxcvbn gives the entropy as 39.6 (including the full stop). However, nobody knows that I generated the way zxcvbn breaks it down." So with that in mind, the permutations of password generation algorithms need to be included as bits of ...


0

The problem with entropy as a measure of password strength is it really does have to be applied to the input not the output. If I base64 encode the word "password" I get something that looks strong, but really isn't. So measuring entropy bits is really a best case. If you look at purely random generation the per symbol entropy for even relatively small ...


1

Sure Snowden's password "algorithm" is now known and that reduce the potential keyspace to an attackable range. Now Snowden is smart enough to know this and I would presume would not use a password based on the same algorithm or even one similar in the future. There are however two issues to consider. The first is information leakage when sharing derived ...


4

As tylerl noted, entropy isn't really a measure of password strength, but it is the best that we've got: The purpose of password complexity is to stand up against a brute-force attack. The size of the smallest available dictionary that contains your password determines the amount of time required to crack your password. We can guess at what ...


1

If you have control over the environment in which the application runs — basically, if you have access to the account under which the application runs — then you can observe everything it does. Simply run the application under a debugger and put a breakpoint or a trace on calls to CryptGenRandom. If you don't have control over the execution of the program, ...


0

Like most password generation algorithms, this one relies on security through obscurity. As long as nobody suspects that you use this method, nobody will use a cracking tool which tries passwords based on trivial patterns on a QWERTY keyboard. But as soon as someone suspects that you might be using it, this would change. As soon as someone feels compelled ...


1

Some wordlists such as rockyou have these sequences in them, so it won't be that safe against a dictionary attack; since dictionary attacks often don't just include normal English words anymore. Furthermore some tools (autocrack, keywalker, ...) exist that specifically test for these, and as Chriss Murray pointed out, it lowers your entropy.


3

Where I've encountered this issue in the past, the best approach I've seen is to script something up in your favorite programming language of choice (e.g. Ruby/Python/Powershell) to retrieve instances of the tokens and then write them to a file. Once you've got a suitable sample, you can load them up into your entropy analysis tool of choice. Another ...


1

This would appear to be better against dictionary and brute force attacks, yes. However, the attacker is not going to limit himself to these types of attacks. The problem with approaches like this, is that they're only secure as long as the attacker doesn't find out that you are generating passwords this way. If the attacker knows that you generate ...



Top 50 recent answers are included