Kuruba
May 14, 2026, 8:27pm
21
lyricism:
I think the issue is just that you can’t really measure entropy of a non-random password. Cryptographic entropy is a property of the mechanism by which the password was generated, not the password itself. That’s why a passphrase of x characters has less entropy than a password with x characters. If someone creates a password that’s just their name any entropy estimate will be inaccurate. You need a secure random method of generation for any entropy estimates to be accurate.
Entropy can be calculated.
Colter
May 17, 2026, 12:51am
22
But what would I do if someone loses his share?
lyricism
May 17, 2026, 11:38am
23
Yes I didn’t say it couldn’t be, but only if you account for how the password was generated. An estimate without that information will be wrong. Most calculations by entropy estimation tools assume it was generated randomly.
???
lyricism:
I think the issue is just that you can’t really measure entropy of a non-random password. Cryptographic entropy is a property of the mechanism by which the password was generated, not the password itself. That’s why a passphrase of x characters has less entropy than a password with x characters. If someone creates a password that’s just their name any entropy estimate will be inaccurate. You need a secure random method of generation for any entropy estimates to be accurate.
For example:
randomperson:
Make sure people you store important stuff with have a system for keeping that stuff and keeping it safe.
Use redundancy. Have four people to keep half a password each, so each half is stored twice.
I think this will go wrong with most people