Random Passwords Aren't Good Enough
summary
Shows that drawing uniformly from an allowed alphabet fails to guarantee required character classes, so 1Password replaces separate sliders with on/off switches and builds a generator that enforces requirements while preserving uniformity. Entropy uses an inclusion–exclusion recursion over the power set of required sets, implemented in Go as 1Password X and published at github.com/1password/spg. Empirical numbers: first-candidate acceptance is ~15% at length 3, >50% by length 6, 94% at 20 and 99% at 32, and the algorithm works within float64 log limits.
AI-written summary · about
chapters (8)
- 0:00Rethinking generators
- 2:05Simplifying the interface
- 3:20Entropy and distribution
- 6:17Algorithmic challenges
- 9:10The problem of uniformity
- 13:02Recursive solutions
- 23:12Probability and impact
- 26:03Implementation and tools
related talks
25mEverything You Know About Passwords Is Wrong
14mPasswords. Are. Not. Hard!
10mImproving Password Generation Through the Design of a Password Composition Policy...
23mFantastic Passwords and Where to Find Them
04mEvery time you write a password validator...
26m“bluegiraffeplaysball” or Make Passwords Great Again Using zxcvbn
01h 05mPasswords are not going away
32mzxcvbn: Low-Budget Password Strength Estimation