Hacker News new | past | comments | ask | show | jobs | submit login

pass phrases do provide a better source of memorable entropy as compared to traditional passwords, but look at the result the the comic comes up with. In this context, where the pass phrase isn't associated with a user name and the "hashes" are globally published pass phrases made up of four common english words would be relatively trivially brute forceable.

Also note that most people following similarly given instructions would actually construct a pass phrase in the form of "subject adverb verb predicate" or "subject verb adjective predicate" or a few other constructions, dramatically reducing the implied entropy of the phrase.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: