Talk:Passphrase

message: There is a conceptual difference between a password and a passphrase. A traditional password is short, and therefore to be secure, it should be random (have high entropy). The idea of the passphrase is to maintain the same total entropy, but lower the entropy per character. This permits the use of phrases that are easier to remember without loss of security. This concept should be included in the main article. It would be better if people would read my original paper* before opining.
--Sig Porter
* "A Password Extension for Improved Human Factors" 
        Crypto 81 (1981 IEEE-CS Workshop on Cryptography) 
        Computers & Security, Vol. 1. No. 1, 1982, North Holland Press
        http://pages.sbcglobal.net/snporter5/passphrase/page1.html
Snporter 03:15, 26 August 2007 (UTC)
thread_title: Difference between a password and a passphrase

message: Why are there passphrases in OpenPGP, when there already is a private key? --Abdull 22:41, 5 October 2005 (UTC)
replies: text: The passphrase is used to encrypt the private key so someone else who gains access to your private key file cannot use it, assuming you have a strong passphrase and the attacker can't employ a keyboard logger or acoustic cryptanalysis or other means to discover your passphrase. --agr 23:13, 5 October 2005 (UTC)
thread_title:  passphrases in PGP 

message: Password:  94 characters (26 lower case, 26 upper case, 10 number, 32 symbol)
Passphrase:  880,000 characters (dictionary) separated by spaces —The preceding unsigned comment was added by Bluefoxicy (talk • contribs) 06:59, 6 April 2007 (UTC)
thread_title:  Passphrase 

message: The page linked has a JavaScript at Pass4All and NOT a URL.
Who has verified that ?  I can find no such reference other than this external link.
Please remove until verified.
passphrases.aule-browser.com is my site and it should not be linked here.
Start with a search on "passphrase generator", please.
example: http://readablepassphrase.codeplex.com/  which provides information as to what the visitor may choose to download.
This link is missing that one crucial level of indirection: the page explaining the what the user is invited to click on and with some semblance of being verifiable witouth investigating page source ( wikipedia users able to do that are able to generate their own passphrases with simple scripts of their own.)
First and foremost, an external link should be a URL to at least information on the passphrase generator and not what this is, a completely uninformative link with an embedded piece of JavaScript. The fact that the external link SAYS "browser button" is not sufficient.
The page in question reads as source
"
<frame marginwidth=0 marginheight=0 frameborder=0 name="TOPFRAME" src="http://www.email-os.com/syncapps/" noresize>
"
so I will remove the link now.
G. Robert Shiplett 20:43, 21 July 2012 (UTC)
thread_title:  who verified the pass4all external link? 

message: This article currently has three different ways of typing passphrase, can we agree on a default and use that or is there a reason it differs?  — Preceding unsigned comment added by Ghanababar (talk • contribs) 10:26, 24 January 2014 (UTC)
replies: text: Thanks for catching that I changed them all to passphrase, except in an reference article title.--agr (talk) 16:09, 24 January 2014 (UTC)
thread_title:  Passphrase vs pass-phrase vs pass phrase 

message: Bill Burr wrote the original NIST Special Publication 800-63. Appendix A,, which advised that all passwords should be a string of random characters and that they should be changed every 90 days, which eventually became the de facto standard for most commercial IT shops. In 2017, though, he had changed his position, in an interview with the Wall Street Journal, saying that random passphrases were more secure and easier to remember. I'd like to add this updated policy to this page, but I'm not sure where to put it. (Citation here and here and below.) — Loadmaster (talk) 16:53, 5 March 2018 (UTC)
thread_title:  Bill Burr