6 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

I think Trey Blalocks answerTrey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That means it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That means it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That means it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

5 added 64 characters in body
source | link

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits or 23 percent, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That is an increase by 174 percentmeans it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits or 23 percent. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That is an increase by 174 percent!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits, meaning it takes 16 times as long to crack. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That means it takes a bit more than a billion times as long to crack!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

4 added 15 characters in body
source | link

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is one ofrandomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy. 

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits or 23 percent. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That is an increase by 174 percent! (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is one of the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy.

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits or 23 percent.

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That is an increase by 174 percent! (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

I think Trey Blalocks answer is great, but I would like to complement it with some math.

If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(171476) or about 17.4 bits of entropy. 

Lets assume there is about 4 natural leet substitution in the average word. Randomly either doing or not doing each substitution adds one bit, so adding the leet would increase the entropy by 4 bits or 23 percent. (If you just use leet for all available substitution you just add one bit - the password is either leet or not leet.)

On the other hand, a completely random 8 character alphanumeric (upper and lower case) password has log2(62^8) or about 47.6 bits of entropy. That is an increase by 174 percent!

So adding leetspeak is slightly better than just taking an english word, but it is not nearly as good as randomizing.

3 added 118 characters in body
source | link
2 edited body
source | link
1
source | link