Diceware & Passwords - Computerphile

TL;DR

Diceware is a password mechanism that uses dice to ensure randomness, providing a mathematically defined level of difficulty for cracking passwords.

Transcript

We've done a few videos on passwords cracking passwords choosing good passwords and I've had had a few requests both by email, and you know Twitter and on in the comments about a choosing a password mechanism called Dice where so I thought we'd look at this and think what's the pros and cons of this of this quite interesting system for choosing Pas... Read More

Key Insights

• 🔑 Diceware provides a mathematically defined level of difficulty for cracking passwords by ensuring the randomness of word selection.
• 🔑 Diceware passwords have a strength of 64.5 bits, meaning an attacker would need to perform approximately 2^63 operations to guess the password through brute-force.
• 🔑 Diceware passwords are more secure than passwords based on picking random words from one's own memory because the word list is openly known and the number of possible combinations is large.
• 🔑 Diceware offers flexibility by allowing users to adjust the number of words in their password based on the desired level of security.
• ✋ Diceware passwords are best suited for scenarios involving high-security needs, such as protection against nation-state level attacks.
• 🔑 Diceware passwords can be easily generated using an online tool that provides guidance on various aspects, such as adding symbols and determining the number of words needed.
• 🔑 The practicality of typing in a Diceware password depends on the specific use case, but for most users, a password composed of five or six words should be manageable.

Questions & Answers

Q: How does Diceware work?

Diceware involves rolling dice to generate random numbers and then using those numbers to select words from a list of 7,776 words. The words are combined to form the password.

Q: Is Diceware a reasonable password choice in terms of strength?

Yes, Diceware passwords have a high level of strength because there are 7,776 possible words for each slot in the password. The number of combinations for a Diceware password is 7,776 raised to the power of the number of words chosen.

Q: How practical is it to type in a Diceware password?

Typing in a Diceware password may take some time since it involves entering multiple words separated by spaces. However, for front-end password managers, the slight inconvenience may not be a big issue.

Q: Can Diceware passwords be made more secure?

Yes, Diceware passwords can be made more secure by adding more words or by introducing random symbols at random positions within the password. However, there is a balance between security and usability that needs to be considered.

Summary & Key Takeaways

• Diceware is a password mechanism similar to using random words with symbols added, but it provides a more mathematically defined level of difficulty for cracking passwords.

• Diceware ensures randomness by using dice rolls to select words from a predefined list of 7,776 words.

• The strength of a Diceware password lies in the number of words chosen, which can be adjusted to increase security.