I was wondering what the real "entropy" (?) for these kinds of passwords is? If you take the vocabulary of common words (ie. not generated from a list of eg. 300k words like in the article), aren't the permutations rather small?
If some person just makes these four words up from words they know (and probably use quite regularly)
Eg 10000^4 or even 1000^4 (for those types who would use "password" otherwise)? Isn't that quite bad or am I understandig something incorrectly?
I was thinking about that... The average person is using 5000 words. We could assume that the poems do too.
(5000^4/ (300,000,000,000))/(60*60) = 0.57 hour with 4 words at 350 billion guess per second (http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...). 1300 years with 6 words.
If you include names, the word list becomes pretty immense. Most of the words any one given person knows are names. If you include at least one name, you're pass phrase is pretty secure.
Comments
I was wondering what the real "entropy" (?) for these kinds of passwords is? If you take the vocabulary of common words (ie. not generated from a list of eg. 300k words like in the article), aren't the permutations rather small? If some person just makes these four words up from words they know (and probably use quite regularly)
Eg 10000^4 or even 1000^4 (for those types who would use "password" otherwise)? Isn't that quite bad or am I understandig something incorrectly?
I was thinking about that... The average person is using 5000 words. We could assume that the poems do too. (5000^4/ (300,000,000,000))/(60*60) = 0.57 hour with 4 words at 350 billion guess per second (http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...). 1300 years with 6 words.
Look at something like Diceware. You have a list of 7776 words. You roll dice to select words. You're recommended to use 7 words or more.
That's plenty secure for most passphrases, even if the attacker has the exact same wordlist as you do.
If you include names, the word list becomes pretty immense. Most of the words any one given person knows are names. If you include at least one name, you're pass phrase is pretty secure.