Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Correct Horse Battery Staple password generator

correcthorse.pw

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Show HN: Correct Horse Battery Staple password generator

#61

Post by daveoc64 »

beardedwizard wrote: post #46

So we are really getting passwords from remote hosted websites? Are people really about to copy, paste and use these right out of the browser?

What is the risk exactly?

Even if the site knew for certain that you had used one of the passwords, they would have no idea where you used the password, and they wouldn't know your username or other credentials.

They might not even have any way of accessing the system you're putting the password into.

I'm sure a lot of people will use these sorts of sites to generate a whole bunch of passwords, and not even use any of them.

Re: Show HN: Correct Horse Battery Staple password generator

#62

Post by ResidentSleeper »

setr wrote: post #59
pkhamre wrote: post #57

Earlier quoted context omitted.

So you're saying that generating a new password looses entropy?

Choosing is the problem here -- it's now only as random as your preference Eg the scheme doesn't do its job well if you don't know the word, so the dictionary can be reduced by that much

On the other hand, I'd wager that the set of words that you can recognize is vastly larger than the set of words that you're likely to come up with on the spot. Hence, using a generator would still result in higher entropy then trying to come up with a password yourself.

Random numbers picked by humans are notoriously biased. I'm guessing it's even worse when you ask them to come up with random words.

Re: Show HN: Correct Horse Battery Staple password generator

#63

Post by daveoc64 »

CPLX wrote: post #31

Can someone explain to me why 1password doesn't have something like this built in? You can use words, or random/symbols, but not both. Which fails miserably every time you're faced with some sort of silly password requirement to have a symbol and a number and a capital or whatever.

Passphrases are easy for people to remember, but if you have a password manager, you're better off getting it to generate a 50+ character random password (including uppercase, lowercase, numbers and symbols).

That should meet pretty much any password requirement, be virtually impossible to guess or brute force, and you won't have trouble remembering it (because you don't have to!).

Re: Show HN: Correct Horse Battery Staple password generator

#64

Post by Jaruzel »

quantum5 wrote: post #2

Background: I liked the xkcd-style password generation scheme as it was easy to remember, but existing generators online (that I could find, at least) all use Math.random() or other cryptographically insecure random number generators. While an actual attack on the RNG seems far-fetched, the very idea doesn't sit well with my crypto nerd side. So I decided to create my own that uses a CSPRNG that I can trust. This was…

Nice idea. Not sure I'm going to remember the 9,999 word password it just generated for me :)

Re: Show HN: Correct Horse Battery Staple password generator

#65

Post by Jaruzel »

tomlagier wrote: post #47
bagacrap wrote: post #25

Earlier quoted context omitted.

you type "glove blinks abruptly avatar salvaging marbled" every time you need to unlock your screen?

Mine's a more meaningful sentence, but about the same length, yes. It doesn't take long to type a wholly-memorized sentence.

Based on the typically strict Corporate 5-minute auto-lock you find on work computers, that would get tiresome REALLY quickly :(

Re: Show HN: Correct Horse Battery Staple password generator

#66

Post by hprotagonist »

bagacrap wrote: post #25
hprotagonist wrote: post #4

I tend to rely on https://www.rempe.us/diceware/#eff for my typeable password needs. 80% of my passwords are just line noise, because they live in a keepass database. 20% (workstation account logins, etc) are diceware.

you type "glove blinks abruptly avatar salvaging marbled" every time you need to unlock your screen?

i type quickly.

Re: Show HN: Correct Horse Battery Staple password generator

#67

Post by professorTuring »

lower, upper and numbers = 62 options | wordlist = 10 000 options:

    62^12     = 1e21
    10 000^5  = 1e20
The problem is you not using a word generator and instead relying in your invention, most of the people will use top 5000 words (5000^5 = 1e18), imagine you can even lock one of the words (a color maybe?).

So this way of thinking might be good if you know what you are doing and use uppers and lowers and symbols, if not, it is actually a bad advice.

Re: Show HN: Correct Horse Battery Staple password generator

#68

Post by mlaci »

pkhamre wrote: post #57
mlaci wrote: post #56

Problem with generators and this scheme, they allow regeneration. Most people not using the first version, they generate a new until they like it enough to stop, which is not that random anymore as they think.

So you're saying that generating a new password looses entropy?

Yes, if the regeneration depends on your preference of the generated words, the words order or link between them. The individual generations independent from each other, so if your choice – how many regeneration you do - not depends on the generations outcome, for example on your birthday date or favorite number, their randomness are equal.

But randomness are not enough, it's possible the first generated version correlate with your preference and that situation does not really matter why are you stopped generating new password.

Predictability of this scheme very good, because the strict rules. All implementation using common english words. For words smaller length, easy spelling, less ambiguity are preferred. Mixing nouns verbs and adjectives are more meaningful, order also adds more meaning. Word count very limited. Preference on the separator character also very rigid. Personal preference more known, because hidding your preference on all english words very hard and mostly unconscious.

Re: Show HN: Correct Horse Battery Staple password generator

#69

Post by asdkhadsj »

daveoc64 wrote: post #61
beardedwizard wrote: post #46

So we are really getting passwords from remote hosted websites? Are people really about to copy, paste and use these right out of the browser?

What is the risk exactly? Even if the site knew for certain that you had used one of the passwords, they would have no idea where you used the password, and they wouldn't know your username or other credentials. They might not even have any way of accessing the system you're putting the password into. I'm sure a lot of people will use these sorts of sites to generate a whole bunch of passwords, and not even use any o…

I'd imagine the risk is pretty great, for the same reason I wouldn't paste a password here that I use. Sure, you may not know who I am, but if you were the site itself you get a ton of information on me.. which is more than I'd like you to know if you _also_ know one of my passwords.

I agree, the risk is minimal. Nevertheless.. security, heh.

Re: Show HN: Correct Horse Battery Staple password generator

#70

Post by asdkhadsj »

daveoc64 wrote: post #63
CPLX wrote: post #31

Can someone explain to me why 1password doesn't have something like this built in? You can use words, or random/symbols, but not both. Which fails miserably every time you're faced with some sort of silly password requirement to have a symbol and a number and a capital or whatever.

Passphrases are easy for people to remember, but if you have a password manager, you're better off getting it to generate a 50+ character random password (including uppercase, lowercase, numbers and symbols). That should meet pretty much any password requirement, be virtually impossible to guess or brute force, and you won't have trouble remembering it (because you don't have to!).

> you're better off getting it to generate a 50+ character random password (including uppercase, lowercase, numbers and symbols).

Lol I wish. Almost all of the important sites I use, like various bills and loans, use terrible password schemes. One even, until recently, enforced an 8 character limit! I think they raised it to 16 iirc. Oy.

Hell, even the company I work for frequently fails my password generator settings. The arbitrary character requirements of my ~20 character password would sometimes not be satisfied when I was creating accounts in our dev system/etc. Which is annoying as hell, but I can't convince management, because our users (older) tend to use some of the worst passwords out there.. so I can understand where it's coming from.

Security & UX is hard.

Post reply on HN