115 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
kelalaka's user avatar
  • 47.6k
74 votes

Password cracking: What if attacker is lucky?

"lucky" is not a property of the attacker. There's no "lucky" attacker nor "normal" attacker. They both have the same probability (low, very low) to guess the key. You can decrease the probability at ...
Gianluca Ghettini's user avatar
42 votes

Password cracking: What if attacker is lucky?

Note: This answer assumes that by "lucky" OP meant "able to remove X% of valid answers", because I believe that was intent. Of course you can't measure luck ;) And if he is very lucky, say 90% ...
axapaxa's user avatar
  • 2,930
32 votes
Accepted

Would this be considered a secure password hash?

Except for the iteration amount ( we can argue that is small, too ‡ and some entropy loss *), the answer is no! There is no memory hardness that mainly prevents massive ASIC/GPU searches There are no ...
kelalaka's user avatar
  • 47.6k
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
thesquaregroot's user avatar
29 votes

Are longer passwords really safer against brute force attacks?

If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. Actually, that might be obvious to ...
poncho's user avatar
  • 145k
25 votes
Accepted

What is the recommended number of iterations for Argon2?

I'm wondering what the recommended number of iterations would be? Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational ...
otus's user avatar
  • 32k
25 votes
Accepted

Password cracking: What if attacker is lucky?

So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit. And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very ...
Chris Dodd's user avatar
24 votes
Accepted

How hard is it to guess a 8 digit PIN?

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \...
Maarten Bodewes's user avatar
  • 91.9k
23 votes
Accepted

Calculating entropy within xkcd 936: Password Strength

I don't get nearly the amount of entropy stated in the comic. Interestingly enough the reasoning for the entropy rating are actually justified in the comic by the little boxes which each represent 1 ...
SEJPM's user avatar
  • 45.7k
22 votes
Accepted

Is using a broken SHA-1 for password hashing secure?

SHA-1 in itself was never safe for password hashing. The hash algorithm itself doesn't have a work factor parameter nor does it have a salt as input. These are requirements for run-of-the-mill ...
Maarten Bodewes's user avatar
  • 91.9k
21 votes
Accepted

Make a Strong, Easy-to-Remember Password Using Classical Cryptography?

I fail to see why one would want to use classical or pencil and paper tools for derivation. For anyone attacking your technique it will make no difference. An attacker with a modern computer will only ...
Meir Maor's user avatar
  • 11.7k
19 votes

How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
Luc's user avatar
  • 1,498
19 votes

Are longer passwords really safer against brute force attacks?

There's a 2013 article in Ars Technica that refutes the notion that long passwords are necessarily hard to crack. It details how security researchers Kevin Young and Josh Dustin turned to text from ...
Luis Casillas's user avatar
18 votes

Password hash that can be upgraded without plaintext password

This is called Client-Independent Update, according to the Catena paper. It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
Sjoerd's user avatar
  • 641
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
Jean-Baptiste Yunès's user avatar
18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
JamesTheAwesomeDude's user avatar
17 votes
Accepted

Encrypting user data with their password?

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf ...
HedgeMage's user avatar
  • 285
17 votes
Accepted

How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
zzantares's user avatar
  • 302
16 votes
Accepted

Using 32 hexadecimal digits vs equivalent 16-character string password

They are both equal. Passphrase security is based on the amount of entropy that the passphrase contains. In your case, both of your pieces of data are only different in the encoding. The actual ...
dusk's user avatar
  • 1,175
16 votes

Cryptography elements needed for a story

Though quantum computers fit the requirements, I'm not sure they are the best option. A general purpose quantum computer capable of attacking modern encryption (RSA, AES) would have serious ...
Meir Maor's user avatar
  • 11.7k
15 votes

Password cracking: What if attacker is lucky?

I'm not sure what you're trying to understand and if the other answers cover it, so I'm trying a different approach and interpret your question like this: What if an attacker guesses the right ...
David Foerster's user avatar
15 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't ...
JesseM's user avatar
  • 462
14 votes
Accepted

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key ...
otus's user avatar
  • 32k
14 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
Paul Uszak's user avatar
  • 15.2k
12 votes
Accepted

Do I need to use a CSPRNG when creating salts for user accounts?

Answering your question If an attacker has access to a copy of my users database table containing each salt and the related salted password, I can't understand how a CSPRNG would be more secure than ...
e-sushi's user avatar
  • 17.8k
12 votes
Accepted

How is the quality of a password calculated and what does it mean?

How much entropy is enough? For a password, something around truly 96-bits of entropy is enough. After all password usually go through some slow password hashing which increases the work load for ...
SEJPM's user avatar
  • 45.7k
12 votes

How strong are Bitlocker recovery keys?

Based on official doc here, unofficial doc there, and confirmed by some experiments: A valid Bitlocker recovery key consists of eight exactly 6-digit decimal numbers separated by seven hyphens (...
fgrieu's user avatar
  • 138k
11 votes
Accepted

Is using 7-8 random words from all words of a language as password a good idea?

The Bitcoin Bip-39 dictionary with 2048 words can create $\approx 2^{263}$-entropy by tossing the coin 256 times to choose the words randomly. The random bits are converted into 24 11-bit blocks and ...
kelalaka's user avatar
  • 47.6k

Only top scored, non community-wiki answers of a minimum length are eligible