Hacker News Reader

Comment by cpach | Hacker News Reader

Very neat! However, IMHO 63 characters is a bit much for the password.

”If you use lower-case, upper-case, and digits, and if you generate it truly randomly, then a 16-character password has 95 bits of entropy. That is more than sufficient.”

Source: https://security.stackexchange.com/questions/15653/recommend...

View on HN

A 63 character password with ten dictionary words is on average much easier to type than a 16 character random ASCII printable string, especially on phone keyboards.

Not on my switch or home entertainment system though.

The PS4 might be a pain (though I haven't tried the gesture typing feature), but the Switch has a touchscreen so there's no issue there.

Fuck me, you are right. I was doing everything with the joycons... Well, there goes half an hour of retyping.

But the 10 dictionary words might be less secure than 16 random characters. xkcd estimates a word has 11 bits of entropy.

Your math is off. Even if you take the 11-bit estimate (if you use something like diceware you get 13 bits), 10 words give you 110 bits. Meanwhile there are 95 ASCII printables, 16 of them give you a maximum of 105 bits, and usually people don’t use the full range (ambiguity, especially painful to type, etc.) & don’t generate a uniformly random string, which means you’re getting fewer than that. Even 95 is an optimistic estimate.

I said "might be", and someone might estimate a word to have 10 bits of entropy. And you previously said dictionary words, not random dictionary words, so a human choosing those words might choose words that relate to each other.

A friend has a ~32 character camel case phrase as his WiFi password.. just a nightmare for people to type on their phones. iOS’s “share pass with contact” helps but every once in awhile someone has to spend 10 minutes trying to get a password to work. So silly.

Your friend needs a guest wifi with “fun friends” as the password that they turn on and off as necessary.

It’s funny that friend goes to the effort of a super long password, but then lets people connect to it.

Reply on news.ycombinator.com