>>105819389
Anon, you're retarded
If you use a list of the 1000 most common words, and pick 4 of them at random, then the attacker has a 1/1000 chance of guessing that word. Let's say 1024 instead of 1000, which is a nice round 2^10. That's what 10 bits of entropy means, the attacker has to find the correct word out of 2^10 possible words
Now if you choose for words, the attacker has to guess all of them. That's (1/1024) * (1/1024) * (1/1024) * (1/1024), or (2^10)^4, or 2^40. The attacker has to choose the correct combination out of 2^40 possible combinations, that's what 40 bits of entropy means
This is a dictionary attack, where the attacker knows exactly which list of words you are using. This is the WORST possible scenario for you. If the attacker uses a larger list of words than you, or goes for a bruteforce attack without a dictionary, the difficulty is tens of orders of magnitude harder
