21–30 of 99 posts
I know XKCD made a comic and everything, but isn't this type of password exactly why dictionary attacks exist?
While I would love to use something like this, almost every site I can think of enforces worthless password rules like "Must include number, letter, special character" etc which effectively blocks these types of passwords.
You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
The main objection I have to sites like this is that they encourage people to use a random untrusted site to generate a password for, say, their bank account.
I know XKCD made a comic and everything, but isn't this type of password exactly why dictionary attacks exist?
I tend to rely on https://www.rempe.us/diceware/#eff for my typeable password needs. 80% of my passwords are just line noise, because they live in a keepass database. 20% (workstation account logins, etc) are diceware.
For passwords I might have to enter by hand, such as WiFi passwords, I liked the pronounceable password option that 1Password used to have. The passwords were several single syllables string together by a separator. An example: neg-pen-nau-eng-fri-dot. There were options to change the separator, and to toss in digits and upper case if I remember correctly. Syllables were 2 to 4 letters long, I believe. At some point…
You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
shuf --random-source=/dev/urandom -n 4 /usr/share/dict/words
[1] https://www.gnu.org/software/coreutils/manual/html_node/Rand...
[2] https://github.com/coreutils/coreutils/blob/v8.5/gl/lib/rand...
[3] https://github.com/coreutils/coreutils/blob/v8.32/gl/lib/ran...
Edit: As ThA0x2 points out in a reply, the latest version of shuf uses /dev/urandom to generate a default nonce, which vastly improves upon older versions. As long as your version of coreutils is at least 8.6 or later and your OS has /dev/urandom, the default should be fine. If you don't have /dev/urandom, even the latest version of shuf (version 8.32, as of June 15, 2020) will still default to an insecure nonce.
You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
no thanks.
You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
Background: I liked the xkcd-style password generation scheme as it was easy to remember, but existing generators online (that I could find, at least) all use Math.random() or other cryptographically insecure random number generators. While an actual attack on the RNG seems far-fetched, the very idea doesn't sit well with my crypto nerd side. So I decided to create my own that uses a CSPRNG that I can trust. This was…
What about https://www.random.org/ ? Why even use a PRNG if you can have the real thing?