Wild Assumptions About Entropy
I recently conducted a brief audit of two factor auth recovery codes patterns employed by major tech companies. One of the factors I considered was how “complex” their patterns were. In other words, how hard it would be for someone (or some machine) to guess the recovery code. As these codes are generated randomly, brute forcing would be the only way to break them.
In computer science, this type of complexity is represented as “bits of entropy”, and the formula for calculating it is pretty straightforward. Unfortunately, it’s a bit too complex for me to do in my head, so I created some JavaScript functions to help.
More…