Timeline for Password security and entropy - degeneracy question
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 6, 2015 at 15:38 | answer | added | Andrew Philips | timeline score: 1 | |
| Oct 19, 2015 at 23:06 | history | tweeted | twitter.com/StackSecurity/status/656244947910270976 | ||
| Oct 19, 2015 at 15:35 | comment | added | user |
You could always add a word separator. It wouldn't significantly change the password complexity, particularly if the method of generation is known, but it would remove these types of "collisions" between words. spark.steam is certainly different from sparks.team.
|
|
| Oct 19, 2015 at 14:37 | comment | added | Paul | @SteveDL I think that password entropy (i.e. actual characterization of the process) is still the best method for characterizing the strength of the generator, because that characterizes their best strategy against me in the average case, even if I can do even better than that by adjusting my strategy to counter common password cracking strategies. | |
| Oct 19, 2015 at 14:26 | comment | added | Steve Dodier-Lazaro | Truth is you need to calculate entropy relative to how often specific words appear in real-world password datasets. "Password entropy" as it is often understood (the number of bits it takes to store all passwords written with the same alphabet as your password) is simply not an appropriate metric. Roughly, make sure to eliminate commonly found words from your generator, and avoid passwords that have very frequent patterns (e.g. starting with Upper, series of Lower and then Digit or Symbol at the end). | |
| Oct 19, 2015 at 14:08 | history | edited | Paul | CC BY-SA 3.0 |
Escape backtick.
|
| Oct 19, 2015 at 13:49 | review | First posts | |||
| Oct 19, 2015 at 13:54 | |||||
| Oct 19, 2015 at 13:44 | history | asked | Paul | CC BY-SA 3.0 |