Hacker News Reader

Comment by zobzu | Hacker News Reader

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

First, that's still beside the point. You shouldn't evaluate a password scheme solely by entropy if it is a password you intend to memorize. XKCD argues that it's easier to remember 4 random words than 8 random characters.

Second, your example isn't very good because it assumes that every 8 byte character (save one) is acceptable, which is rarely the case, especially if you are trying to memorize them.

Finally, as another commenter pointed out, you've got your math wrong, and even your example has more entropy for the words than the characters.

Incorrect: It's 171k^4 and 255^8.

(which works out to 8.55E20 and 1.78E19)

Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15.

I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.

Right- I was just correcting the dude's math :-)

hey it was an honest typo

>the 8 char password has much less entropy: 95^8 ~= 6.63E15 //

Most of the word usage is going to be limited though too. testyourvocab.com put the average at 27k I think. We're looking for words one can remember easily so the word pool is going to be a lot lower - 15000^4 ~= 5E16 FWIW.

Yep, and that's assuming 8 random bytes from extended ASCII. The other point of the article was that nobody actually makes a password from random characters because words are easier to remember. And I think it's disingenuous to suppose people will enter alt-codes and that nonprintable characters would be allowed, so assuming MENSA-quality users with internal random number generators, we get 95^8 ~= 6.6E15, a clear loss of entropy.

yeah thats correct

No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.

real complex passwords are more like '"^vmds!w*é$sé550µW"'-à the point of the post was to show the maximum theorical possibilities for both. As many pointed out not all 255 are usually printable and not all 171K words are used then that's for english only and not counting old english and not taking care of possible punctuation

It's actually closer to 92^8 (printable ASCII) or even 62^8 (if they only allow letters and numbers).

Reply on news.ycombinator.com