Hacker News new | ask | show | jobs
by Aachen 1541 days ago
3 words is not enough usually, but it technically depends on the dictionary size. Since the formula is dictsize^numwords, adding a word to your phrases is a lot better than adding a thousand words to your dictionary (also because of diminishing returns above ~5 thousand words).

Iirc 6 words is a good size for most dictionaries or 7 words for diceware, but might be off by one so please look around. I remember posting it on the security stackexchange site (I'm currently on mobile, not logged in or I'd look it up in my user) and I'm not the only one who's done this calculation. It also depends on what security level you need (e.g. should it prevent from offline brute force or only online brute force)

1 comments

Why are you assuming the advesary knows what dictionary is being used?
Because there are only so many words in the world and an English person isn't going to use a Dutch dictionary. At that point it's going to be harder to remember than just random characters of the same entropy.