AS Cherbourg Football (69 words) [view diff] exact match in snippet view article find links to article
Randomly-generated passphrases offer a major security upgrade over user-chosen passwords. Estimating the difficulty of guessing or cracking a human-chosen password is very difficult. It was the primary topic of my own PhD thesisand remains an active area of research. (One of many difficulties when people choose passwords themselves is that people aren’t very good at making random, unpredictable choices.)
Several word lists have been published for different purposes; thus far, there has been little scientific evaluation of their usability. The most popular is Arnold Reinhold’s Diceware list, first published in 1995. This list contains 7,776 words, equal to the number of possible ordered rolls of five six-sided dice (7776=65), making it suitable for using standard dice as a source of randomness. While the Diceware list has been used for over twenty years, we believe there are several avenues to improve the usability and are introducing three new lists for use with a set of five dice (as part of its Summer Security Reboot Campaign, EFF is providing a dice set to donors).
Diceware passwords need spaces to be correctly decoded, e.g. inand put are in the list as well as input.
We based our list off of data collected by Ghent University’s Center for Reading Research. The Ghent team has long studied word recognition; you can participate yourself in their online quiz to measure your English vocabulary. This list gives us a good idea of which words are most likely to be familiar to English speakers and eliminates most of the unusual words in the original Diceware list. This data also includes “concreteness” ratings for each words, from very concrete words (such as screwdriver) to very abstract words (such as love).
The result is our own list of 7,776 words [.txt] suitable for use in dice-generated passphrases. The words in our list are longer (7.0 characters) on average, than Reinhold’s Diceware list (4.3 characters). This is a result of banning words under 3 characters as well as prioritizing familiar words over short but unusual words.
Note that the security of a passphrase generated using either list is identical; the differences are in usability, including memorability, not in security. For most uses, we recommend a generating a six-word passphrase with this list, for a strength of 77 bits of entropy. (“Bits of entropy” is a common measure for the strength of a password or passphrase. Adding one bit of entropy doubles the number of guesses required, which makes it twice as difficult to brute force.) Each additional word will strengthen the passphrase by about 12.9 bits.
We are also introducing new lists containing only 1,296 words (64), suitable for use with four six-sided dice. By reducing the number of words in the list, we were able to use words with a maximum of five characters. This can lead to more efficient typing for the same security if it requires fewer characters to enter Nshort words than N-1long words.
Finally, we’re publishing one more short list [.txt] which with a few additional features making the words easy to type:
All words are at least an edit distance of 3 apart. This means that future software could correct any single typo in the user’s passphrase (and in many cases more than one typo).
We’ve added these features in the hope that they might be used by software in the future that was specially designed to take advantage of them, but will not offer a significant benefit today so this list is mostly a proof-of-concept for individual users. Software developers might be able to find interesting uses for this list.
Different lists might be preferable in different situations, and that’s perfectly fine. For example, you might consider using one of the short lists when you are prioritizing ease of remembering, or when you know that the highest level of passphrase strength is not necessary. This might cover a website login that offers additional protections, like two-factor authentication, and that rate-limits guesses to protect against brute force.
If you are typing the passphrase frequently (as opposed to using a passphrase database), you might prioritize reducing the length of the words. Our long list has an average length of 7.0 characters per word, and 12.9 bits of entropy per word, yielding an efficiency of 1.8 bits of entropy per character. Our short list has an average length of 4.5 characters per word, and 10.3 bits of entropy per word, yielding 2.3 bits of entropy per character. Out typo-tolerant list is much less efficient at only 1.4 bits of entropy per character. However, using a future autocomplete software feature, only three characters would need to be typed per word, in which case this would be the most efficient list to use at 3.1 bits of entropy per character typed.
You might find the shorter average length in the original Diceware list to be preferable. That’s perfectly fine as well, given the caveats we mentioned about the difficulty of using this list. Note that the original Diceware list offers 3.0 bits of entropy per character and hence less typing. As discussed above, we feel the large number of short words in this list (including single letters and bigrams) are hard to remember and hence a bad tradeoff to decrease typing time.
Since passphrases are individually chosen, it’s okay for multiple lists to exist. In fact, this might even increase security, as it means the attacker has some uncertainty about which list was used to generate a passphrase.
We think our lists will be useful for people generating passphrases using EFF’s dice (or otherwise), though they certainly aren’t the last word on the matter. There’s plenty of room for further research and experimentation on memorability and ways of optimizing lists and we hope people will keep exploring this area.
The webinar will discuss ongoing DHS initiatives, career development capabilities, and potential employment opportunities.
Scattered throughout many levels on Halo 3, there are large freight crates, similar to the ones in Halo 2. The company logo is shown on the side of the crate - "TRAXUS". TRAXUS was an Artificial Intelligence (AI) on Marathon, one of Bungie's Earlier games.
Unfortunately the person above is wrong. Traxus was the ORIGINAL AI used and unfortunately crashed causing them to reboot it under the name "Durandal". Next time do your homework
come on guys calm down its just a game. so he got some things wrong just correct him and move don't tell him to do his homework =P
Actually Traxus is an AI from the Marathon universe. He is referred to in a terminal discussing rampancy in the beginning of the game, Traxus IV's rampancy was a historical incident because he caused the most damage.