Hacker News Reader

I think this misrepresents password entropy. For example forcing a capital letter mostly results in lusers capitalising the first letter (and losing about 1 bit versus having the choice of case for every character). Requiring "special characters" further decreases the entropy (certainly in theory, and I assume in practice).

View on HN

I used https://www.omnicalculator.com/other/password-entropy to calculate it by the way. I threw out a few examples but you're right, it does come down to individuals knowing what to do or not. Those aren't meant to be good examples of passwords to use in practice.

For the record, it's pretty easy to do this by hand. The calculator assumes the attacker knows how many of each kind of character there is, which is a weird assumption so I'll not use that. Anyway you can take the base-2 log of the number of possibilities, or more easily add the entropies of each character (if they're not related). If you take e.g. the 64 symbols of Base64 as your allowed space you get: n*log_2(64)= 6n bits of entropy for an n-character password.

Give that most brute forcing is probably going to be done with wordlists and various permutations, I found this site to be interesting for estimating real password strength: https://lowe.github.io/tryzxcvbn/

Reply on news.ycombinator.com