Hacker News Reader

Comment by hyperbovine | Hacker News Reader

Of course the human brain routinely stores memories which are vastly larger than 56 bits. The trick is in mapping those to passwords. For instance, if you went to grade school in the US I claim you can easily remember the following password: ipattfotusoaattrfwisonugiwlajfa. ("I pledge allegiance to the flag...") Song lyrics tend to work particularly well.

View on HN

A question is how much entropy a string like this has? Say you have 10 million English songs, if you always start a password with the first letter from a song, and choose the password to have between 20-30 letters, you only have about 26 bits of entropy in the password, which is trivial to brute force. You can increase the entropy by starting from a different word, or inserting random characters, but the entropy will never be close to the entropy of a random string of the same length.

This is an insecure approach. Dictionary style attacks now can account for phrases from vast libraries of literature, pop culture, or anything else you're likely to remember.

But the suggestion is to carry out a simple hash on the input phrase — one could use the second or third letter, for instance. (Or the first, second, third, first, second, third…)

How could a dictionary-style attack predict all possible such arrangments?

Why not? The only limit on password cracking techniques is combinatorial complexity. This gives an overview: http://arstechnica.com/security/2013/10/how-the-bible-and-yo...

But do they take into account obscure maintenance manuals for foreign cars?

> Of course the human brain routinely stores memories which are vastly larger than 56 bits.

Usually because they are LOW-entropy. Spelling rules, grammar rules, rhymes, shared culture, all of those things erode any utility they may have had as random or unpredictable.

Reply on news.ycombinator.com