Meccha Entropippi めっちゃエントロピッピー

This article is a theoretical musing and exploration into fun spaces of cryptography, as a thought experiment. Nothing I express here is security advice or should be practically implemented as a real-world solution. The point of this article is conceptual discussion.

Consider a simple scenario. You are a thief. You have infiltrated my office, and on my monitor is a sticky note that says: My bank account password: tifalockhartforever24. You now have a very obvious course of action. You try the password. Either it works, or it doesn't. If it doesn't, you've exhausted the value of that particular piece of information within a few minutes.

Next imagine the same scenario, except there are a billion sticky notes on my monitor, each claiming that my bank account has a different password. One of them might be correct. None of them might be correct. You can investigate them, but the problem has fundamentally changed. What was previously a single highly actionable piece of information has become an enormous search problem.

Now imagine there is also a large note that says: My password is made from some combination or subset of the information on these sticky notes. The problem becomes considerably larger. Perhaps some notes should be placed before others. Perhaps groups of two, three, four, or more should be combined. Perhaps only substrings matter. Perhaps those substrings should be reordered, repeated, encoded, hashed, transformed, combined with the results of other transformations, or fed recursively into still further transformations.

Because no limit has been placed on how the material can be assembled or transformed, there is now an infinite space of possible derivations.

The billion sticky notes therefore do something more useful than merely create a very large collection of possible passwords. They make it increasingly difficult to determine what is signal and what is noise.

There is also one final possibility: None of it was real.

This is the basic security proposition behind Meccha Entropippi. If one piece of information about you might matter, what happens when there are billions? Meccha Entropippi explores the idea of publishing a lifetime of plausible noise around yourself, making it increasingly difficult and expensive to determine what means anything at all.

Becky Brown's My Passwords (2020) is a brilliant piece that ties unexpectedly into the central thesis of this article. At 77 × 55.5 inches, Brown takes the familiar appearance of an ordinary handwritten password list and blows it up to absurd, monumental proportions. Most critically, she simply puts the passwords on display.

In the terminology of this article, I can't help seeing My Passwords as an exceptionally elaborate and artful Meccha Entropippi, and she did it years before I coined the term.

For most people, cybersecurity eventually becomes passwords, scraps of paper, recovery codes, forgotten credentials, increasingly elaborate rules, and whatever personal systems we devise to survive an increasingly hostile digital environment. To me My Passwords elegantly captures something absurd and deeply relatable about modern security: behind all of the sophisticated cybersecurity, eventually there is just a person trying to remember their passwords.

Entropy is a measure of uncertainty or unpredictability. In cryptography, it is commonly used to describe how difficult something such as a randomly generated password or key would be to guess. Throughout this article I also use entropy somewhat playfully as a noun meaning a quantity of random-looking data. For example, I might call this “a lot of entropy”:

90fd7c5ed4d060c121083b4ac9d99a32f7583285837bd78f02352079bd4306c5d6a9a0e91b09aae1e7a97b015ea799ad72464cd5a4a9e428d6846c6f3ab4caaa7d278031227da8ad5bb1d84d943e5eb5ae3adb7e44879dd29610b11aa480563c7f34963e7bfe780b50a5d5105c65e42e1afef58195380b609f1a028243b2fe15c57361ab13426cbb563a812b824ac6a5302a542892ed6a5c32900450867e907c

Technically, the string itself doesn't tell us how much entropy went into it. That depends on how it was generated.

Meccha Entropippi is a thought experiment understood as the strategies and constraints to think about the idea. (One last reminder for posterity: none of this is a suggestion to actually do it. See the disclaimer above. Onward.)

At the pinnacle, mic-drop moment of the song, Marin—the green member—declares 💚やりゃ できんじゃん (yarya dekin jan), which roughly means:

"See? You CAN do it!"

And I'm here to tell you that you ALSO can do Meccha Entropippi.

Or can you...

I speculate that free SaaS hosting might actually be the best place for this. That gives us plenty of possible hosts: social media, source control, forums, email, distribution platforms and whatever else will accept arbitrary user-generated data. The possibilities are nearly endless and can get increasingly creative, but to name a few basic ones:

However, I would not be quite as zealous as Marin on this particular subject. These companies will happily tolerate endless quantities of human language but may become considerably less enthusiastic when that language turns into endless quantities of noise. How much they tolerate will naturally vary by platform.

There are probably enough legitimate avenues that, over a lifetime, you could accumulate an unreasonable amount of publicly associated entropy without any single location containing very much of it at all.

There's also a very bright side: The SaaS companies mutually benefit from this by having all your personal entropy to sell to brokers, and also they can use your personal entropy to train their AIs on.

So really, it's a win-win for everyone. The platforms get to sell your entropy. The AI gets better by training off your entropy. You get your own personal entropy. And we can all be MECCHA-CHA-CHA VERY SUPER HAPPY about it.