> It generates those passwords for you, and they're short, one-time-use combinations of three English words
If an attacker knows the tool does this, doesn't this reduce the keyspace to crack to (number of words in an English dictionary)*3? Is that enough? Am I missing something?
A very complete dictionary has around 170K words, let's generously assume the password generator is willing to use all of them, many that will be unfamiliar and cumbersomely large to an actual native English speaker. So 510K in the keyspace, around 19 bits of "key". Maybe that's enough?
> It generates those passwords for you, and they're short, one-time-use combinations of three English words
If an attacker knows the tool does this, doesn't this reduce the keyspace to crack to (number of words in an English dictionary)*3? Is that enough? Am I missing something?
A very complete dictionary has around 170K words, let's generously assume the password generator is willing to use all of them, many that will be unfamiliar and cumbersomely large to an actual native English speaker. So 510K in the keyspace, around 19 bits of "key". Maybe that's enough?