Entropy isn't sufficient to measure password strength

&gt; Because choosing good passwords is about memorableness as well as sheer strength<p>That&#x27;s not been true ever since the development of good password managers. There are fewer than 10 passwords I remember. One of them is my password manager&#x27;s master passphrase (5 misspelled-and-with-random-punctuation words). The others include stuff like my work and home laptop&#x2F;disk passwords, which I can&#x27;t autofill, my 3 important banking passwords which I do not even entrust to my password manager, and my AppleID password because iOS is annoying enough at asking for that that I&#x27;m using one I can remember.<p>The other ~600 entries in my password manager are 25 random characters (or whatever the upper limit if password length is for sites&#x2F;services that are &#x27;doin it wrong&#x27;).

Maybe I just don&#x27;t have trendy-enough coworkers or friends...but I know of no one who actually analyzes password strength in terms of <i>Shannon</i> entropy. Cripes, the very first sentence of the Wikipedia page for Shannon entropy tells us that it&#x27;s an <i>average</i>.<p>Simple analogy - if the goal was to protect your house from a 9-foot-deep flood, would a dike with an <i>average</i> height of 10 feet do the job?

When will we stop using passwords?! They are an elementary school kid “secret club” game taken way, way too far. They are totally broken. Nobody can come up with and remember good passwords. Nobody can store passwords securely. 100% busted.<p>Instead of continuing to debate what makes a good password, we need to put our energy into better techniques altogether! No more shared secrets! Let’s talk about one-time codes, asymmetric key cryptography, hardware tokens, anything but passwords!!

Kolmogorov complexity&#x2F;entropy is more suitable for this purpose, under the implicit assumption that password crackers don&#x27;t have tailored prior knowledge and are just enumerating &quot;simple&quot; sequences. It only agrees with Shannon entropy on long ergodic sequences. The author basically constructed an example where the two notions don&#x27;t agree.

There&#x27;s a bit of a logical flaw here in that the argument is made against average entropy of a set of passwords, rather than individual entropy of each chosen password.<p>This is an argument I can&#x27;t find anyone making: an aggregate average entropy of the set of all passwords you use is fine for password security, rather than the entropy of each individual password.<p>As far as I can tell this seems to be a (possibly intentional?) misunderstanding on the author&#x27;s part.

The real question here is if there are any actually used password strategies where this distinction matters? In practice, no one would ever use the type of password strategy described.

It’s important to remember that attackers get no information on how close they are (assuming good hashing practices). It is unknowable to them if you went with the correcthorsebatterystaple approach or placed your cat on the keyboard for a few minutes. Given that, a simpler alphabet with longer strings &gt; more complexity with shorter strings.

Cool example. An attacker will take 2^234 guesses <i>on average</i> to guess the password, but that&#x27;s an average of 19 1&#x27;s and one enormous number. So the attacker will usually guess the answer quickly. It&#x27;s kind of like the St. Petersburg paradox in that the expectation value doesn&#x27;t reflect typical behavior.<p>Seems like this might be a use case for &quot;dispersion&quot; (the second moment of entropy) [1].<p>[1] <a href="https:&#x2F;&#x2F;math.stackexchange.com&#x2F;questions&#x2F;1626522&#x2F;higher-moments-of-entropy-does-the-variance-of-log-x-have-any-operationa" rel="nofollow">https:&#x2F;&#x2F;math.stackexchange.com&#x2F;questions&#x2F;1626522&#x2F;higher-mome...</a>

The argument feels like a straw man.<p>He seems to be saying, if your password selection strategy skews towards really weak passwords, and you measure the Shannon entropy of the distribution, it won&#x27;t reveal that this is a bad strategy.<p>I don&#x27;t know anyone who would actually do this and declare a win &quot;because Shannon&quot;.<p>At best, it&#x27;s mildy interesting that Shannon entropy on its own isn&#x27;t going to give you a useful answer if you have a weak strategy.

I thought it&#x27;s the entropy of the chosen password not about the entropy of the possibilities of password you could choose

I typically use a phrase from my life e.g.<p>MathsDegree@StamfordWasABigWin [1] RanThroughAPlateGlassDoorWhenTen [2]<p>with some esoteric obfuscation rules.<p>1. I don&#x27;t have a maths degree from Stamford. 2. Did happen, not one of my passwords.

Hasn&#x27;t this problem been solved for decades by diceware?<p>Use words as your characters with a dictionary of a few thousand words. Assume an attacker knows the dictionary. Make passwords that are too long to brute force (40+ characters). Use enough words that a dictionary attack is also infeasible (4+). Add a salt if you&#x27;re feeling extra spicy.<p>Entropy is sufficient if you use the right language model.

This is a good place to advertise <a href="https:&#x2F;&#x2F;phrase.shop" rel="nofollow">https:&#x2F;&#x2F;phrase.shop</a> - a webapp I wrote that makes secure yet memorable passphrases.<p>It makes entropy requirements explicit, and you can even roll your own dice to supply the required entropy to generate your passphrase.<p>Try it, it&#x27;s fun!

It seems like it is still sufficient for passwords that are generated in a normal way.

<a href="https:&#x2F;&#x2F;xkcd.com&#x2F;936&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;936&#x2F;</a>