New answers tagged passwords
3
Like Ray, I'd like to point out that if the PINs are not chosen randomly but selected by humans and there is no rejection of the easiest pins, the same rules as for passwords apply: some are very, very, very common.
This analysis of 4-digit pins shows that 3 tries will allow you to break over 18% of 4-digit pins, not the 0.03% you would expect from the ...
0
Maarten and Max correctly analyze the probabilities for cases in which the PIN is selected uniformly from all 8 digit numbers. But if the user is permitted to choose their own PIN, the distribution will be biased towards those numbers that are easily memorable. (Naturally, the exact distribution will differ from person to person and thus can't be calculated ...
7
The chance to guess right is just
$$\frac{3}{10^x}$$ where in your case, $x$ is $8$.
You could write it as
$$1-\frac {99999999}{100000000}\cdot\frac {99999998}{99999999}\cdot\frac {99999997}{99999998}=1-\frac {99999997}{100000000}=\frac 3{100000000}$$
To simplify it, just imagine a one digit PIN. You have ten possibilities, from 0 to 9. With three tries, ...
23
If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits.
The chances of guessing the PIN correctly in 3 tries is $$1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{...
1
You should expect that an attacker will sooner or later know your algorithm, no matter how complex you construct it. The security is more reliable when it depends not on the secrecy of algorithm, but on the secrecy of data. This approach is known as Kerckhoffs's principle.
If we apply this principle to your case, we should expect that the attacker can ...
2
Only randomly generated components matter for passwords/passphrases.
6 randomly generated symbols: lower/uppercase letters and numbers.
You have 26+26+10 possible characters, so 62.
The entropy of a password is $L\log_{2}N$, where $N$ is the number of possible symbols and $L$ is the number of symbols in the password. So you have $6\log_{2}62=35$ bits ...
0
This is heavily dependent on which corpus of passwords is used, but what you're looking for is Markov chains trained on common password corpora.
Markov chains are superior to simple frequency-position tables because choice of next character is often heavily influenced by more than just the previous character, but a few characters back.
For example, this ...
1
In terms of English language, what you are asking about are digram frequencies.
http://www.viviancook.uk/SpellStats/DigFreqs.html
0
I wrote a PHP script to create a basic output.
Here are the results:
https://pastebin.com/raw/mgKaAKA5
It can be better with a better source though.
2
Using the HKDF algorithm would work:
prk = HKDF-EXTRACT(salt, master_key)
Key1 = HKDF-EXPAND(prk, "info 1", digest_len)
Key2 = HKDF-EXPAND(prk, "info 2", digest_len)
This creates two keys that are generated from the master key, but given Key1, someone else wouldn't be able to generate Key2, as they don't know the master key.
4
Yes, 7-8 words selected truly at random make a strong password.
First we should consider what is a strong password, we measure the strength of a method of generating passwords by how much entropy is in it.
The XKCD method https://xkcd.com/936/ uses 4 random commom words and has 44 bits of entropy.
This is considered a reasonable compromise if you want a ...
9
The Bitcoin Bip-39 dictionary with 2048 words can create $\approx 2^{263}$-entropy by tossing the coin 256 times to choose the words randomly. The random bits are converted into 24 11-bit blocks and every block is mapped into one of the 2048 words by ID. Since the random choice allows repetition, we need $n^r$ not $P(n,r)$;
$$2048^{24} \approx 2....
Top 50 recent answers are included
