2 Clarified effects of increasing entropy by 10 bits.
source | link

Yes, it does help, but perhaps not as much as you would think.

A password/phrase is a sequence of tokens. In a password, the tokens are characters; in a passphrase the tokens are words.

To increase the resistance of a password/phrase to brute force attacks, you can:

  • increase the number of tokens in the sequence (i.e. make it longer)
  • increase the number of possible tokens used (i.e. use a bigger set of characters or words.)

This is called increasing the entropy of the password/phrase.

An important point it that a passphrase (series of words) is also a password (series of characters). An attacker might attack it as a password or as a passphrase, and it's resistance to the attack is different depending on how the attacker treats it.

If the attacker treats it as a password, the main factor is length (since there are few tokens used in words). If they treat it as a passphrase, the main factor is number of tokens (since the length is so short).

So, should you use foreign words? Well, if the attacker treats it as a password, it makes no difference. Length is length. "chicken" and "oiseau" increase the length be the same amount, as does "skdjnqs" and "aaaaaaa" for that matter. If the attacker treats it as a passphrase, then it does make a difference. Using words from French and English almost doubles the number of possible tokens. So it does help, but as I mentioned, not as much as you'd think.

This is because increasing length is a much more powerful technique than increasing number of tokens. A three-word passphrase in english has an entropy of about 40; a three-word passphrase in french and english has an entropy of about 44, but a six-word passphrase in english has an entropy of 81.

In fact, if you run the numbers, it turns out that adding a single extra english word increases the entropy of a passphrase to 54 - ten more than you get by using two languages. Ten bits of extra entropy means a brute force attack will more than a thousand times longer to run.

So thatadding another word is a much better way to strengthen your passphrase.

(Although an even better way is to add a small random password with numbers and punctuation.!)

Lastly I will mention that the phrases in your examples are not random, which is a weakness against generated dictionary attacks, so you should think about that as well. You want something more like CorrectĈevaloBatteryStaple.

Yes, it does help, but perhaps not as much as you would think.

A password/phrase is a sequence of tokens. In a password, the tokens are characters; in a passphrase the tokens are words.

To increase the resistance of a password/phrase to brute force attacks, you can:

  • increase the number of tokens in the sequence (i.e. make it longer)
  • increase the number of possible tokens used (i.e. use a bigger set of characters or words.)

This is called increasing the entropy of the password/phrase.

An important point it that a passphrase (series of words) is also a password (series of characters). An attacker might attack it as a password or as a passphrase, and it's resistance to the attack is different depending on how the attacker treats it.

If the attacker treats it as a password, the main factor is length (since there are few tokens used in words). If they treat it as a passphrase, the main factor is number of tokens (since the length is so short).

So, should you use foreign words? Well, if the attacker treats it as a password, it makes no difference. Length is length. "chicken" and "oiseau" increase the length be the same amount, as does "skdjnqs" and "aaaaaaa" for that matter. If the attacker treats it as a passphrase, then it does make a difference. Using words from French and English almost doubles the number of possible tokens. So it does help, but as I mentioned, not as much as you'd think.

This is because increasing length is a much more powerful technique than increasing number of tokens. A three-word passphrase in english has an entropy of about 40; a three-word passphrase in french and english has an entropy of about 44, but a six-word passphrase in english has an entropy of 81.

In fact, if you run the numbers, it turns out that adding a single extra english word increases the entropy of a passphrase to 54 - ten more than you get by using two languages. So that is a much better way to strengthen your passphrase.

(Although an even better way is to add a small random password with numbers and punctuation.)

Lastly I will mention that the phrases in your examples are not random, which is a weakness against generated dictionary attacks, so you should think about that as well. You want something more like CorrectĈevaloBatteryStaple.

Yes, it does help, but perhaps not as much as you would think.

A password/phrase is a sequence of tokens. In a password, the tokens are characters; in a passphrase the tokens are words.

To increase the resistance of a password/phrase to brute force attacks, you can:

  • increase the number of tokens in the sequence (i.e. make it longer)
  • increase the number of possible tokens used (i.e. use a bigger set of characters or words.)

This is called increasing the entropy of the password/phrase.

An important point it that a passphrase (series of words) is also a password (series of characters). An attacker might attack it as a password or as a passphrase, and it's resistance to the attack is different depending on how the attacker treats it.

If the attacker treats it as a password, the main factor is length (since there are few tokens used in words). If they treat it as a passphrase, the main factor is number of tokens (since the length is so short).

So, should you use foreign words? Well, if the attacker treats it as a password, it makes no difference. Length is length. "chicken" and "oiseau" increase the length be the same amount, as does "skdjnqs" and "aaaaaaa" for that matter. If the attacker treats it as a passphrase, then it does make a difference. Using words from French and English almost doubles the number of possible tokens. So it does help, but as I mentioned, not as much as you'd think.

This is because increasing length is a much more powerful technique than increasing number of tokens. A three-word passphrase in english has an entropy of about 40; a three-word passphrase in french and english has an entropy of about 44, but a six-word passphrase in english has an entropy of 81.

In fact, if you run the numbers, it turns out that adding a single extra english word increases the entropy of a passphrase to 54 - ten more than you get by using two languages. Ten bits of extra entropy means a brute force attack will more than a thousand times longer to run.

So adding another word is a much better way to strengthen your passphrase.

(Although an even better way is to add a small random password with numbers and punctuation!)

Lastly I will mention that the phrases in your examples are not random, which is a weakness against generated dictionary attacks, so you should think about that as well. You want something more like CorrectĈevaloBatteryStaple.

1
source | link

Yes, it does help, but perhaps not as much as you would think.

A password/phrase is a sequence of tokens. In a password, the tokens are characters; in a passphrase the tokens are words.

To increase the resistance of a password/phrase to brute force attacks, you can:

  • increase the number of tokens in the sequence (i.e. make it longer)
  • increase the number of possible tokens used (i.e. use a bigger set of characters or words.)

This is called increasing the entropy of the password/phrase.

An important point it that a passphrase (series of words) is also a password (series of characters). An attacker might attack it as a password or as a passphrase, and it's resistance to the attack is different depending on how the attacker treats it.

If the attacker treats it as a password, the main factor is length (since there are few tokens used in words). If they treat it as a passphrase, the main factor is number of tokens (since the length is so short).

So, should you use foreign words? Well, if the attacker treats it as a password, it makes no difference. Length is length. "chicken" and "oiseau" increase the length be the same amount, as does "skdjnqs" and "aaaaaaa" for that matter. If the attacker treats it as a passphrase, then it does make a difference. Using words from French and English almost doubles the number of possible tokens. So it does help, but as I mentioned, not as much as you'd think.

This is because increasing length is a much more powerful technique than increasing number of tokens. A three-word passphrase in english has an entropy of about 40; a three-word passphrase in french and english has an entropy of about 44, but a six-word passphrase in english has an entropy of 81.

In fact, if you run the numbers, it turns out that adding a single extra english word increases the entropy of a passphrase to 54 - ten more than you get by using two languages. So that is a much better way to strengthen your passphrase.

(Although an even better way is to add a small random password with numbers and punctuation.)

Lastly I will mention that the phrases in your examples are not random, which is a weakness against generated dictionary attacks, so you should think about that as well. You want something more like CorrectĈevaloBatteryStaple.