Hacker News Reader

Comment by scythe | Hacker News Reader

You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.

View on HN

Some Koreans do this: they just type up some Korean words. Since most password fields only accept ASCII symbols, the password gets entered as a nonsensical string of alphabets. For example, the Korean word '비밀번호' (meaning 'password'), when typed on a standard Korean keyboard, becomes 'qlalfqjsgh'.

Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast. E.g. suppose English and German have the same number of words, then using both only gives you one more bit per word.

(Actually, slightly less since some words exist in both languages. Like `hell'.)

>Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast.

Well, sure -- but once you're at around two or three languages, you get to imagine that the attacker doesn't know what languages you're using. If I use English, Japanese, and Spanish, I can figure on the attacker needing to check the Germanic (English, Dutch, German), Romance (Spanish, French, Italian), and Asian (Japanese, Chinese, Korean) languages at a minimum.

Jargon helps too, and proper names. "dijkstra bicycle entonces boojum daihinmin"

Always assume the attacker knows your scheme, but not your random bits.

>Jargon helps too, and proper names. "dijkstra bicycle entonces boojum daihinmin"

Instead of that, just add an extra common word: "correct horse battery staple bicycle".

Reply on news.ycombinator.com