5 ms·
I just opened the Password app for the first time to look at the generator. It seems like the pattern is: [a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6} with ex
by tuxone 2y ago
I just opened the Password app for the first time to look at the generator. It seems like the pattern is: [a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6}\-[a-zA-Z0-9]{6} with exactly only one uppercase char and one digit. I don't want to do the maths but that looks like a lot of removed entropy.
- timabdulla 2y agoHe mentions the entropy in the article...
- tuxone 2y agoRight, thanks. So from 160 bits down to 70 bits of entropy (there is also fancy syllables and bad words to take into account).
- eviks 2y agoQuite the opposite > these new passwords have 71 bits of entropy, up from the 69 from the previous format.
- tuxone 2y agoI am referring to the loss of entropy compared to a (theoretically) fully random 20-chars password.
- nneonneo 2y agoNit, 160 bits of entropy would be if you could get 8 bits per character, but that’s highly unrealistic. 6.0~6.3 bits is more feasible based on what most websites will tend to accept, which lands you at around 120-126 bits of entropy for a fully random password.
- deleted 2y ago[deleted]
- Veliladon 2y ago*They just FYI.
- nneonneo 2y agoFully random: 62^18 in that format, or about 107 bits of entropy. Their approach: ~71 bits per the article (I counted ~73 bits but I’m not using their exact algorithm) I’d say it’s not too bad. With a good password hashing algorithm you’re looking at nearly 2^100 operations to bruteforce their passwords, which isn’t going to be feasible anytime soon. (Even with a crappy hash algorithm it’s still going to be over 2^80 operations). And, in this case, that entropy trade off means the passwords are easier to remember and type in, making it more likely for humans to actually use those passwords.