Skip to main content
deleted 5 characters in body
Source Link
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

Passwords do not have entropy, only the method used to generate the password has entropy.

If the attacker knows you use a wordlist then they can use the same wordlist to construct their guesses. If you take off the last letter of each word in your generation list, and the attacker knows this, they simply take off the last word in theirs. The entropy would be exactly the same.

Your technique may enable your chosen passwords to go under the radar in a non-targeted dictionary attack, however in any targeted attack they may discover how you generate your passwords and alter their wordlist accordingly (e.g. from other breaches that may reveal your password when it has been cracked, from public website posts, etc).

Passwords do not have entropy, only the method used to generate the password has entropy.

If the attacker knows you use a wordlist then they can use the same wordlist to construct their guesses. If you take off the last letter of each word in your generation list, and the attacker knows this, they simply take off the last word in theirs. The entropy would be exactly the same.

Your technique may enable your chosen passwords to go under the radar in a non-targeted dictionary attack, however in any targeted attack they may discover how you generate your passwords and alter their wordlist accordingly (e.g. from other breaches that may reveal your password when it has been cracked, from public website posts, etc).

Passwords do not have entropy, only the method used to generate the password has entropy.

If the attacker knows you use a wordlist then they can use the same wordlist to construct their guesses. If you take off the last letter of each word in your generation list, and the attacker knows this, they simply take off the last in theirs. The entropy would be exactly the same.

Your technique may enable your chosen passwords to go under the radar in a non-targeted dictionary attack, however in any targeted attack they may discover how you generate your passwords and alter their wordlist accordingly (e.g. from other breaches that may reveal your password when it has been cracked, from public website posts, etc).

Source Link
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

Passwords do not have entropy, only the method used to generate the password has entropy.

If the attacker knows you use a wordlist then they can use the same wordlist to construct their guesses. If you take off the last letter of each word in your generation list, and the attacker knows this, they simply take off the last word in theirs. The entropy would be exactly the same.

Your technique may enable your chosen passwords to go under the radar in a non-targeted dictionary attack, however in any targeted attack they may discover how you generate your passwords and alter their wordlist accordingly (e.g. from other breaches that may reveal your password when it has been cracked, from public website posts, etc).