A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words.
One variant is the “short word list (with words that have unique three-character prefixes)”. They write about this list
Finally, we're publishing one more short list [.txt] which with a few additional features making the words easy to type:
- Each word has a unique three-character prefix. This means that future software could auto-complete words in the passphrase after the user has typed the first three characters
- All words are at least an edit distance of 3 apart. This means that future software could correct any single typo in the user's passphrase (and in many cases more than one typo).
We've added these features in the hope that they might be used by software in the future that was specially designed to take advantage of them, but will not offer a significant benefit today so this list is mostly a proof-of-concept for individual users. Software developers might be able to find interesting uses for this list.
But why would they hope for software developers to implement auto-complete? Couldn’t they just tell the users “remember the whole world, but just type the first three characters” to get the same effect – no loss of security, but shorter passphrases?
Also, I noticed that the list contains words like viperfish that seem awfully redundant – wouldn’t the shorter word viper work just as well in its place? Similarly, mapmaker could just be map, capsule could be cap, older could be old. Is there a reason why they have not just chosen the simplest, shortest english word for a given three-letter prefix?
