Can someone explain to me why 1password doesn't have something like this built in? You can use words, or random/symbols, but not both. Which fails miserably every time you're faced with some sort of silly password requirement to have a symbol and a number and a capital or whatever.
Show HN: Correct Horse Battery Staple password generator
31–40 of 99 posts
Re: Show HN: Correct Horse Battery Staple password generator
#32While I would love to use something like this, almost every site I can think of enforces worthless password rules like "Must include number, letter, special character" etc which effectively blocks these types of passwords.
There is an option on correcthorse.pw to add a number and/or a special character as needed.
Re: Show HN: Correct Horse Battery Staple password generator
#33You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
serioludicrous simpleheartedness seminiferal phrenologize no thanks.
For easier-to-remember passphrases, you can download the EFF wordlist from https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt and specify that file instead of /usr/share/dict/words
Re: Show HN: Correct Horse Battery Staple password generator
#34You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
This may not be cryptographically secure. Shuf can default to using a small amount of entropy.[1,2,3] To be certain, you can add the --random-source option: shuf --random-source=/dev/urandom -n 4 /usr/share/dict/words [1] https://www.gnu.org/software/coreutils/manual/html_node/Rand... [2] https://github.com/coreutils/coreutils/blob/v8.5/gl/lib/rand... [3] https://github.com/coreutils/coreutils/blob/v8.32/gl/lib/ran..…
[deleted]
Re: Show HN: Correct Horse Battery Staple password generator
#35You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
This may not be cryptographically secure. Shuf can default to using a small amount of entropy.[1,2,3] To be certain, you can add the --random-source option: shuf --random-source=/dev/urandom -n 4 /usr/share/dict/words [1] https://www.gnu.org/software/coreutils/manual/html_node/Rand... [2] https://github.com/coreutils/coreutils/blob/v8.5/gl/lib/rand... [3] https://github.com/coreutils/coreutils/blob/v8.32/gl/lib/ran..…
I'm curious how practical an RNG attack actually is here (which absolutely isn't meant to serve as criticism of your surfacing the issue!).
In any case, I expect it's much harder than a random "free password gen!" website saving results on the sly (... which is meant to be mild criticism of your framing, but not your recommendation :-p).
Re: Show HN: Correct Horse Battery Staple password generator
#36Earlier quoted context omitted.
This may not be cryptographically secure. Shuf can default to using a small amount of entropy.[1,2,3] To be certain, you can add the --random-source option: shuf --random-source=/dev/urandom -n 4 /usr/share/dict/words [1] https://www.gnu.org/software/coreutils/manual/html_node/Rand... [2] https://github.com/coreutils/coreutils/blob/v8.5/gl/lib/rand... [3] https://github.com/coreutils/coreutils/blob/v8.32/gl/lib/ran..…
I'm curious how practical an RNG attack actually is here (which absolutely isn't meant to serve as criticism of your surfacing the issue!). In any case, I expect it's much harder than a random "free password gen!" website saving results on the sly (... which is meant to be mild criticism of your framing, but not your recommendation :-p).
Depends on the situation.
I definitely wouldn't try this on a freshly booted Raspberry Pi, for example.
Re: Show HN: Correct Horse Battery Staple password generator
#37You can achieve this with a one-liner: shuf -n 4 /usr/share/dict/words
This may not be cryptographically secure. Shuf can default to using a small amount of entropy.[1,2,3] To be certain, you can add the --random-source option: shuf --random-source=/dev/urandom -n 4 /usr/share/dict/words [1] https://www.gnu.org/software/coreutils/manual/html_node/Rand... [2] https://github.com/coreutils/coreutils/blob/v8.5/gl/lib/rand... [3] https://github.com/coreutils/coreutils/blob/v8.32/gl/lib/ran..…
shuf uses randint(), which defaults to /dev/urandom as the nonce source:
https://github.com/coreutils/coreutils/blob/v8.31/gl/lib/ran...
Your "--random-source=/dev/urandom" line is superfluous. My original line is as secure as yours.
Re: Show HN: Correct Horse Battery Staple password generator
#38Can someone explain to me why 1password doesn't have something like this built in? You can use words, or random/symbols, but not both. Which fails miserably every time you're faced with some sort of silly password requirement to have a symbol and a number and a capital or whatever.
Lately I'll use the word-based recipe in 1PW and add in a capital letter, special character and number before saving. This should be very easy to automate, I too am surprised they haven't offered this yet as an e.g. "salted passphrase."
Re: Show HN: Correct Horse Battery Staple password generator
#39I tend to rely on https://www.rempe.us/diceware/#eff for my typeable password needs. 80% of my passwords are just line noise, because they live in a keepass database. 20% (workstation account logins, etc) are diceware.
you type "glove blinks abruptly avatar salvaging marbled" every time you need to unlock your screen?
I don't know about GP, but I certainly do.
Re: Show HN: Correct Horse Battery Staple password generator
#40Nice work!
A passphrase, as opposed to a password, has spaces between each word.
If you added those it would be easier to read, especially for mobile, if you used a multiline textarea, because the generated content isn’t fully readable at a glance. (Or don’t use a form input field at all — just put the passphrase in a div so the word breaks flow normally.)