Quote from: btchris on June 18, 2015, 11:41:07 AM

Quote from: grau on June 17, 2015, 03:31:03 PM

If those words were used as an alphabet then they would define a 2048^12 or 132 bit key space.

The word lists are instead hashed (see BIP39) which gives an approximate entropy of 2.62*4.5*12 = 141 bits.

FYI BIP-39 (and Electrum 2.x) starts with a specific amount of entropy, and then derives the words from that entropy, not the other way around as you implied. Typically, this is 128, 192, or 256 bits for 12, 18, or 24-word long mnemonics.

(and of course the hashing which follows does nothing to increase that initial entropy)

Yes, the user would be a worse source of entropy if he was to chose the words directly.
My point is, that if you are able to encode entropy into 12 words then it can not be more than entropy represented by 12 words, no matter of its source.

You are right, that there are options generating a longer list, but I think default is 12 in popular wallets.