Comment by Terretta | Hacker News Reader

Comment by Terretta | Hacker News Reader

Parent Full thread

> to imply that a passphrase is more secure than a short random password

I noted to internalize the idea, the entropy idea versus human "random" passwords which aren't random at all. "Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables or easy attacks. See my link #1 in GP comment for reference.

That's why I said "pass-phrases are stronger than monkey rules".

Meanwhile, "random" passwords don't necessarily come up stronger. Forget just seven. Let's use 1Password's random sixteen (16) char generator as an example[1]:

    2Fro%7gMfQbwBktm : 85.3 bits of entropy from 72 char set
    [xNyCHZc44RzPeMJ : 85.1 bits of entropy from 82 char set

Meanwhile, going by length and charset alone and ignoring whether the characters are words (using my passphrase from GP comment):

    thisphraseisdefinitelynotinthedictionary : 153.7 bits of entropy from 26 char set

The thing is, when you're attacking Evernote's database, you don't know someone's using XKCD's idea. So you're not looking at (2048^4) [2]. You're looking at (using the XKCD password):

    correct horse battery staple : 104.2 bits from 27 char set

If as an attacker we magically know "thisphraseisdefinitelynotinthedictionary" is words without spaces, and even assume they come from the 2048 word set (though neither "definitely" nor "dictionary" are in that 2048 word set), then by your formula:

    log_2 (2048^8) = 8 * 11 = 88 bits of entropy

markedly stronger than your example random password's 45.99 bits. And as I noted, "far more memorable", meaning such a phrase could be used by regular folks.

1. Quick entropy check: http://rumkin.com/tools/password/passchk.php

2. Manual entropy check: http://www.wolframalpha.com/input/?i=log_2%282048%5E4%29

Respectfully, you are flat out wrong. This "entropy check" doesn't prove what you think it does.

This password strength test is attempting to estimate the entropy of given passwords under the assumption that it is a word roughly obeying the character distributions of English text, using Shannon's approximation. It does not apply to randomly generated passwords, which violate these assumptions, as described in Appendex A of the NIST plublication linked on that very site.[1] As that document describes, the entropy of a randomly (not user!) selected password is not estimated in this manner, but calculated according to the same formula I provided: H = log_2 (b^L), where b is the number of letters in the alphabet (95) and L is the length of the password. (If the password had any less entropy than that, then by definition it would not have been pseudorandomly generated!)

Additionally, the algorithm employed by this site does not take into account that an intelligent password cracker is capable of exploiting the construction of passphrases.

In other words, you've taken an algorithm designed to approximate the entropy of a user-selected password and misapplied it to both randomly-generated passwords and user-selected passphrases. The fact that the algorithm is able to give you a number for these inputs does not mean it is any valid indication of how difficult such a password or passphrase would be to crack.

[1] http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1...

EDIT: But you're right that passphrases can be easier to use by people. I personally think a password manager like keepass / lastpass / etc. is a better choice than trying to select a memorable password, though.

First, all this is beside the point. Evernote hasn't understood the concepts of either entropy or human chosen passwords. Rejecting my passphrase and accepting "abc123" is wrong. That's my original post, and that's what you objected to. Computer generated random passwords that nobody's going to use on their mobile phone Evernote client, simply don't figure into normal human use.

Our job is to recommend things that can help real people use tech more safely.

> "the entropy of a randomly (not user!) selected password is not estimated in this manner, but calculated according to the same formula I provided: H = log_2 (b^L), where b is the number of letters in the alphabet (95) and L is the length of the password"

Yes, I'm aware of that. Using that site's check, "correct horse battery staple" comes out weaker at 104.2 bits, so I listed that weaker "lower bound"[1] for that phrase. I'm happy to use whatever formula comes up with less entropy for reasons discussed in [1].

I also don't care when sharing with less technical users if it's exact. I care if I can point them to a URL that gives a reasonable approximation, which that "quick check" does. For users who want to do math, I listed both approaches:

> 1. Quick entropy check: http://rumkin.com/tools/password/passchk.php

> 2. Manual entropy check: http://www.wolframalpha.com/input/?i=log_2%282048%5E4%29

The "manual" check is pre-filled with your suggested formula. It's interesting to compare the entropy check to http://www.passwordmeter.com which I think users will "solve" as if it were a password meter puzzle, in very predictable ways.

Meanwhile, to an attacker trying the whole character space, "correct horse battery staple" is log2(27^28) or 133.1 bits of entropy. And if you use H = log_2 (b^L) on the passphrase that Evernote wouldn't accept, it comes in at 188 bits of entropy.

In any case, the approximation is a more conservative "lower bound" than the formula you're suggesting as applied to character set ^ length.

> I personally think a password manager like keepass / lastpass / etc. is a better choice than trying to select a memorable password, though.

I agree. And I use 1Password and generate random passwords.

Btw, the two truly random passwords from 1Password (equivalent of keepass, lastpass, etc), if working with the H = log_2 (b^L) formula, give only 98 bits and 101 bits. Again in their case, the "quick entropy check" URL gives lower numbers, meaning it's a remains a reasonable "lower bound" check for casual users who don't grok formulas.

I tell non-technical family members and friends who can't be bothered with password minders to use sentences meaningful to them and unlikely to be in a book.

    This phrase is definitely not in the dictionary! : 227 bits or 286 bits

That's a pretty good password that my Mom can remember.

--

1. lower bounds: http://subrabbit.wordpress.com/2011/08/26/how-much-entropy-i...

While "This phrase is definitely not in the dictionary" is true, every component is. If this sort of password became popular brute forcing passwords would just start using whole word combinations when cracking passwords. i.e a word becomes the equivalent of a character (though from a larger set of characters).

Also wouldn't a hash of a long passphrase be longer? (I am completely ignorant the details of hashing algorithms)... so if I'm cracking a table of hashed passwords, I could set a "passphrase" cracker on hashed passwords of above average length?

No, the hash is always the same length, a single character and a 4GB movie will generate a hash of the same length (using the same hash algorithm (md5, sha512, etc). I've casually read about it, I think that is the point of the hash, to take an input of any size or length and represent it as a fixed size.

The problem with this is hash collisions, weaknesses found in hash algorithms can make it so attackers could generate files to match another files hash (or password or w/e). I think the idea is that they create a harmful file, then add null characters or w/e so the hash algorithm will generate/assign the two different files the same hash.

The key idea behind any hashing algorithm is to take inputs of any length and turn them into an output of a fixed length.

Different problem domains have different additional requirements: password hashes want to minimise collisions (multiple inputs hashing to the same output), checksums want to make similar inputs produce wildly different outputs, hashtable/dictionary/map key hashes want to create an even distribution of outputs etc. But the thing common to all hashing algorithms is the output is the same size.

When cracking passwords attackers don't just use brute force. The most effective attacks are ones that exploit human patterns such as leet replacements, capital first letter, punctuation at the end, etc. Concatenated words in all lowercase with no spaces is another pattern that can easily be added to their list and probably already is there, so yes, you can assume that that they will be looking at the space of 2048^4 such passwords.

> The most effective attacks are ones that exploit human patterns such as leet replacements...

I think you missed my first paragraph, where I made that point:

"Normals" are using their name with a 3 instead of an E, or some word with a 1 on the end. This tends to put them in rainbow tables _or_easy_attacks_.

Also, my example passphrase that I was annoyed Evernote wouldn't let me us isn't log2(2048^4), but ~ log2(5000^8) even assuming you know it is words.

This thread is getting of on the tangent of debating XKCD's particular formula. XKCD is not the point.

My original post asked Evernote Team to please grok the idea of that cartoon, which it's obvious they had not given their clearly wrong tips and rejection of a very strong password and acceptance of one of the weakest.

Reply on news.ycombinator.com