Skip to main content
Commonmark migration
Source Link

tl;dr:Q1: a little, Q2: about the entropy of the original dice ware

##longer version

longer version

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

tl;dr:Q1: a little, Q2: about the entropy of the original dice ware

##longer version

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

tl;dr:Q1: a little, Q2: about the entropy of the original dice ware

longer version

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

added 91 characters in body
Source Link
Tobi Nary
  • 14.5k
  • 8
  • 46
  • 59

tl;dr:Q1: a little, Q2: about the entropy of the original dice ware

##longer version

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

tl;dr:Q1: a little, Q2: about the entropy of the original dice ware

##longer version

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.

Source Link
Tobi Nary
  • 14.5k
  • 8
  • 46
  • 59

Purely adding additional characters, even if they are not random, should not harm your pass phrase strength, abstractly.

Yet there are some concerns; most importantly here maybe: an attacker given knowledge about your technique could probably deduce from you typing your pass phrase:

  • the length of the dice ware you started with
  • which are the added words to generate a sentence from that (because they are generally short)
  • which words in which positions are more likely (because grammar; not every word off the dice ware dictionary (depending on the dictionary, of course) can be modified into a word that fits the sentence structure)

This last point reduces the possible combinations you can start with, which the attacker can take into account. From there, it might be possible that part of your pass phrase is already leaked; the words in between follow strict grammatical rules and are thus relatively easy to guess.

This is also the answer to your second question. The entropy you are adding to create a valid sentence is low, as most is syntax with very little room for play. So the calculator is overrating your construction by far.

Still, if I'm not overlooking something here, the overall strength of your modified dice ware result should generally be at par with the original one.