Re: Password entropy

[Graham Toal <gtoal () UTPA EDU>]

> > Which is a better password?
> >
> >     abcdefghijklmnopqrstuvwxyz
> >     1angtPalftm
>
>  The second one is better by far. Cracking time is a function 
> of entropy, the more basic the pattern, the less entropy. The 
> first 'password' you show has a very simple pattern.

Has anyone mentioned NIST FIPS 181 yet?

I don't personally think it's all that great, but I suspect
it does wonders for complaints from the auditors...

(talking of entropy, you need a good entropy generator
for a random password generator.  I've seen so many obfuscated
sources which boiled down in the end to either a 16 bit
PRNG seed, or using a clock() value that could be guessed
to within a few minutes!  I think FIPS 181 uses your previous
password as a seed, which has to be pretty dubious!)

G
http://www.itl.nist.gov/fipspubs/fip181.htm