2

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations for some common cases and hardware. The tool is available here.

As has been said over and over again, these strength & recovery calculations are averages, and only apply if the words are chosen at random. The tool offers 2 options for random choices. The online mode uses http://www.random.org. Offline mode uses the Excel RND function. I have 2 questions.

Commenters state that "Entropy is a property of the generation process". I agree that it is not (only) a property of the passphrase. But isn't strength (entropy) above all, a property of the combination of passphrase and recovery process?

The random choice option in the tool is a 2 step process when using the Internet as a source. The first step gets random (dictionary word) numbers from the Internet. To make the final pass-phrase choice less NSA-able, the dictionary sequence is randomized before words are picked from the dictionary by their random word number from step 1.

For sure the first step delivers a random choice. But is the final choice still a random choice when I randomized the dictionary before choosing? (using a local random pseudo generator)

Community
  • 1
Dick99999
  • 525
  • 5
  • 8
  • Every non-dictionary password is good. There exist much faster way to get inside then to crack passwords :) – jirib Oct 08 '13 at 12:36
  • Don't agree or recommend that to access password vaults for example. And how do you know your password is not in a 1.5 billion long 'dictionary'? By using a passphrase! – Dick99999 Oct 08 '13 at 14:58
  • My comment was about that too complicated passwords make people not to remember them and write them down on a paper closed to computer :) This is reality. Way forward is to use dual-factor authentication (something you know, something you have). – jirib Oct 09 '13 at 08:25
  • What about apps that use a (derived) password as an encryption key, like a password vault. 2-factor authentication is fine to protect regular access to the vault. But if the encrypted vault is stolen, you still depend on the passphrase only, don't you? – Dick99999 Oct 10 '13 at 11:08

0 Answers0