[eterm]

But don't do what someone I know did and replace every single e with 3, every single a with 4, every single o with 0.

Identical entropy, extra theatre.

[mnarayan01]

Not to imply that what you describe is a great strategy, but I wouldn't describe it as pointless. The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

[mistercow]

>The password "12345" has the same entropy as "b0g4p" but it would be a mistake to think they are equally secure.

Those do not have remotely equal entropy.

[mnarayan01]

At the byte level it does, which is presumably what the OP was talking about when saying that replacing characters with digits (uniformly) does not affect entropy.

[mistercow]

Maybe, but I would hope that's not what s/he meant, because that kind of entropy is basically irrelevant to password strength.

[eterm]

Is bogap a dictionary word?

What I'm describing are passwords like

T1g3rF33t Cam3lT03

etc.

All dictionary stuff along a theme, but made "secure" by applying a zero-entropy substitution of all occurrences of (L,O,A,E) with (1,0,4,3).

Given that crackers know people do this, they add them to their dictionary attack routines so this is no more secure.

Given I'm still fighting with them over, "don't store passwords plain text" I've not even begun to attack them over this practice yet.

[mnarayan01]

Ha no...I just randomly typed in symbols. Guess it does look kind of "wordish" though.

[mistercow]

I don't think that's identical entropy, since the usage of that strategy varies, and the non-substitution case is more common. But it probably adds less than one bit, and last I checked, 2 * instant = instant.