Hacker News Reader

I refuse to believe that there are no tools that can dictionary attack sentences.

I'm willing to bet that the set of 8-character full-ASCII passwords is comparable in cardinality to the set of 8-word sentences, even accounting for Markov information density.

Using a grammar and a dictionary of common words I can see attacks on 3 or 4 word passwords being somewhat feasible although I should do some back of the envelope calculations.

An easier way is to use n-grams. You can download 3 and 4 word n-grams from google here: http://ngrams.googlelabs.com/datasets

There are roughly 32 billion of google 4-grams.

Those are unique per year, so the phrase "a simple but potentially" is counted many times. There are about 600 million google 4-grams, slightly more than there are 4-character ascii strings.

Summing up, a meaningful 4-word phrase, is, in the terminology of the article, "risky".

My advice: use generated passwords, and apps like 1password to remember them.

Reply on news.ycombinator.com