I like to use the diceware method to generate passwords. But i also wonder, why there are so bad words used in for example the german list. There are a lot of words like
15411 bj
15412 bk
15413 bl
that are not actually words, not even common abbreviations, that are much too short and cant be remembered properly. Is that only a problem of the german list? And why aren't there much more lists, for english there are two as far as I know. For german I could only find one.
The Diceware FAQ has two entries that address this:
Why are there so many meaningless words like abc, du, rrrr or 456 in the Diceware list?
An important goal of Diceware is to keep passphrases short. Based on the limited survey I did, I concluded that most people simply will not accept a 50 character passphrase that they have to type in several times a day to read, send or sign e-mail. Peter Kwangjun Suk had the clever idea that short non-words like "abc" "456" or "dn" are about as easy to remember as regular words and reduce the average length of a randomly selected password.
Also, I never heard of ncaa, boise or a&p.
The original Diceware word list is slanted somewhat to American English. Alan Beale has compiled an alternative list that replaces most Americanisms and many obscure words with more recognizable alternatives. You can find it at http://world.std.com/~reinhold/beale.wordlist.asc
There are some obscure words in both lists. If you passphrase includes a word you don't know, look it up in a good dictionary. Learning the word's meaning will aid you memory and your vocabulary.
You're not the first person to raise your objection, however, and plenty of people disagree with Rheinhold's criteria. The simplest solution is to use a different word list. For example, the Electronic Frontier Foundation designed and published alternative word lists based on criteria that agree with your objection:
The Diceware list can provide strong security, but offers some challenges to usability. In particular, some of the words on the list can be hard to memorize, hard to spell, or easy to confuse with another word.
- It contains many rare words such as buret, novo, vacuo
- It contains unusual proper names such as della, ervin, eaton, moran
- It contains a few strange letter sequences such as aaaa, ll, nbis
- It contains some words with punctuation such as ain't, don't, he'll
- It contains individual letters and non-word bigrams like tl, wq, zf
- It contains numbers and variants such as 46, 99 and 99th
- It contains many vulgar words
- Diceware passwords need spaces to be correctly decoded, e.g. in and put are in the list as well as input.
Note that several of these problems are exacerbated for users with a soft keyboard or other typing systems that relies on word recognition. Using only valid dictionary words makes this setup much easier.
If you like the EFF word list better, just use that. You're going to be typing quite a bit more, which I think illustrates Rheinhold's motivation:
The words in our list are longer (7.0 characters) on average, than Reinhold's Diceware list (4.3 characters). This is a result of banning words under 3 characters as well as prioritizing familiar words over short but unusual words.
For a 6-word passphrase with spaces between the words, that's 47 vs. 31 characters on average.
No, it's not only the German version. If you look at the original English version, it starts like this:
11111 a
11112 a&p
11113 a's
11114 aa
11115 aaa
and ends like this:
66664 ?
66665 ??
66666 @
It contains many other non-words similar to those in your question as well, such as cx, jr, etc.
Regarding your complaint that these aren't words: the description of the list says:
The complete list contains 7776 short words, abbreviations and easy-to-remember character strings.
The alternative list is no better in this regard.
As to why these are included, the paper Picking a Strong Passphrase with Diceware by Arnold Reinhold explains the reasoning behind it:
Why are there so many meaningless words like abc, du, rrrr or 456 in the Diceware list?
An important goal of Diceware is to keep passphrases short. Based on the limited survey I did, I concluded that most people simply will not accept a 50 character passphrase that they have to type in several times a day to read, send or sign e-mail. Peter Kwangjun Suk had the clever idea that short non-words like abc, 456, or dn are about as easy to remember as regular words and reduce the average length of a randomly selected password.
If you are looking for lists without these words, the EFF published one.
