This question already has an answer here:
- Does the haystack theory work 2 answers
I was wondering how sound is the concept presented by the Gibson Research Corporation (see below if you do not want to follow the link) about simple passwords (= very easy to remember) with the addition of padding.
I understand what Gibson is getting at with increased search space, etc., but I was wondering if this applies to a real world scenarios, i.e., everyday use for your accounts and peace of mind that the passwords are 'secure' even if their entropy is super low.
FOR THOSE THAT DO NOT WANT TO GO TO THE WEBSITE:
Gibson has a search space calculator which indicates what is the search space for a given password. The search space depends on length of passwords and characters that form the password itself (letters - uppercase and lowercase - and/or numbers and/or symbols)
He then goes on about the importance of the length of a password and the mixture of letters, numbers and symbols.
Everything does perfectly sense, but then, he argues that "entropy" is not important, in his own words:
ENTROPY: If you are mathematically inclined, or if you have some security knowledge and training, you may be familiar with the idea of the “entropy” or the randomness and unpredictability of data. If so, you'll have noticed that the first, stronger password has much less entropy than the second (weaker) password. Virtually everyone has always believed or been told that passwords derived their strength from having “high entropy”. But as we see now, when the only available attack is guessing, that long-standing common wisdom . . . is . . . not . . . correct!
He refers to 2 passwords:
And argues that although the first one is infinetely more memorable than the second one (and even contains a dictionary word) the time to 'crack' it is orders of magnitude greater than the required time for the other, hence, it is more secure.
Is this concept sound? In lay terms... Shall I change all my passwords to something like the first one (super easy and super long) or this is just asking for troubles in todays hyper-connected world? :)
Is entropy completely useless in the "online account passwords" world?
Maybe this question should be asked on StackOverflow since concerns more with practical use of low-entropy passwords in computer systems authorization mechanisms woth regards to password cracking. Don't know...
Is this ok now or shall I be even more concrete? Is this off-topic altogheter?