Practicing privacy: Encryption
matt.might.net
Practicing privacy: Encryption
1–10 of 20 posts
Re: Practicing privacy: Encryption
#2> By long, I mean greater than 16 characters, and perhaps longer than 20.
Talk about going overboard... furthermore this in combination with "Don't use words or "clever" variations on words" make it all but likely that you're going to forget your own password and write it down.
Re: Practicing privacy: Encryption
#3> By long, I mean greater than 16 characters, and perhaps longer than 20. Talk about going overboard... furthermore this in combination with "Don't use words or "clever" variations on words" make it all but likely that you're going to forget your own password and write it down.
If you can't remember 1 password over 20 characters that you will use a lot with a password manager you probably need to change what kind of passwords you make.
Instead of "E=ESet the password manager to make you enter the password if you haven't used it for 30 seconds (for a few days so you remember your password).
You're using a password manager with a good password that is easy to remember but the you do use the password manager to generate hard to remember passwords like the one above.
Re: Practicing privacy: Encryption
#4> By long, I mean greater than 16 characters, and perhaps longer than 20. Talk about going overboard... furthermore this in combination with "Don't use words or "clever" variations on words" make it all but likely that you're going to forget your own password and write it down.
If you can't remember 1 password over 20 characters that you will use a lot with a password manager you probably need to change what kind of passwords you make. Instead of "E=E Set the password manager to make you enter the password if you haven't used it for 30 seconds (for a few days so you remember your password). You're using a password manager with a good password that is easy to remember but the you do use the…
Re: Practicing privacy: Encryption
#5For cloud services I'd recommend Lastpass (works with Yubikey 2 factor) for password management and Tarsnap for backups.
Re: Practicing privacy: Encryption
#6"Encryption makes privacy a right that can be claimed rather than granted."
Not really, or at least not alone. There will always be points at which information must be encrypted. Encryption just pushes the need for the right to be granted to those points. This is not at all a bad idea, of course; just that government recognition of a right to privacy is still important.
Re: Practicing privacy: Encryption
#7> By long, I mean greater than 16 characters, and perhaps longer than 20. Talk about going overboard... furthermore this in combination with "Don't use words or "clever" variations on words" make it all but likely that you're going to forget your own password and write it down.
If you can't remember 1 password over 20 characters that you will use a lot with a password manager you probably need to change what kind of passwords you make. Instead of "E=E Set the password manager to make you enter the password if you haven't used it for 30 seconds (for a few days so you remember your password). You're using a password manager with a good password that is easy to remember but the you do use the…
Do not give password advice without looking at the entropy.
Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not going to be the case (this one being a modification of a line from a nursery rhyme), so in actuality it'll be even worse.
A fully random password of length 20, from characters on a typical keyboard (say 94, it seems to be on mine) would have 20 * lg(94) > 20 * 6.5 = 130 bits. But impossible to remember and a pain to type correctly.
Picking from my /usr/share/dict/words with no restrictions (99171 entries), it would take 70 / lg(99171) = 5 words to be stronger than the sentence and 130 / lg(99171) = 8 words to be stronger than the gibberish, with no substitutions or tweaks, however not all of those passwords could be typed on my keyboard.
Restricting /usr/share/dict/words to those which match (with LANG=C) '^[a-zA-Z]\{1,10\}$' yields 61078 words at about 7.3 bits of entropy per word, so you would get security comparable to the above with 5 (again - aliasing) and 9 words respectively.
Some nine-word passwords generated this way:
embryo distressed Ramadan chocks broaching official outstript explicit formulas
tokens bruskly realizing rubric earmarks aphorism sweeps hallelujah Bardeen
respects jocularity crummier leave spinsters Rodriquez hatch assurance torture
patinas Elba dairymaids blabbing kissing handyman Ind tobogganed directed
mossy Flora concepts medalist kidding heinously deafened evaluation nodes
Steinmetz lizard Janette scatted cunning geckos belched demurring grandest
faints nicest unleashes navel Monroe frostbites Pl loon careening
overtake tasselled quahog utters Upjohn incloses punchy Jericho reveille
sicked sinning premiere Satanism loiters accrual Caspar infatuate renewable
dinning hereabouts Lithuanian formalism voiceless demoted bundle teed fluent
This is, obviously, reliant on an assumption that rl produces cryptographic level randomness, which is probably not the case but should certainly be near enough the case for examples (and in any case will be much, much closer to true than any method involving humans - we are very poor sources of cryptographic entropy).
Re: Practicing privacy: Encryption
#8For cloud services I'd recommend Lastpass (works with Yubikey 2 factor) for password management and Tarsnap for backups.
Worth pointing out that if you use LastPass and the US government wants a list of all of the accounts you use, a history of when you logged in to them, the IPs you were using when you logged in, and your usernames and passwords, they can get it.
All they need is a court order to compell LastPass to target your account with some modified backdoored JS. They have done this before to force Hushmail to send backdoored java applets to targetted users.
I used LastPass for a very short time. I now use a PGP encrypted text file.
Re: Practicing privacy: Encryption
#9Earlier quoted context omitted.
If you can't remember 1 password over 20 characters that you will use a lot with a password manager you probably need to change what kind of passwords you make. Instead of "E=E Set the password manager to make you enter the password if you haven't used it for 30 seconds (for a few days so you remember your password). You're using a password manager with a good password that is easy to remember but the you do use the…
Do not give password advice without looking at the entropy. Estimates of the entropy of English text place it below 1.5 bits per character. "The brown cow jumps over the moon." would, generously, have about 34 * 1.5 = 51 bits of entropy, plus a few more for the simplistic substitutions - say 70 bits total? This is assuming the sentence was, in fact, chosen uniformly across English sentences, which is obviously not go…
There is also the excellent Diceware: http://world.std.com/~reinhold/diceware.html
Re: Practicing privacy: Encryption
#10> By long, I mean greater than 16 characters, and perhaps longer than 20. Talk about going overboard... furthermore this in combination with "Don't use words or "clever" variations on words" make it all but likely that you're going to forget your own password and write it down.
> make it all but likely that you're going to forget your own password and write it down.
Writing down your password is usually less risky than picking a weak password.
As always, assess the risks.