11–20 of 37 posts
In case it's not obvious, this is an absurdly terrible service you should never use. Here is some free software that accomplishes the same task, which is almost surely not more likely to give your password to third parties than just typing it on the same machine would: echo $(shuf --random-source=/dev/urandom -n 6 /usr/share/dict/words)
I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
Do the math. Yes, your 1password password is stronger. But does it really matter?
See http://world.std.com/%7Ereinhold/dicewarefaq.html#howlong
In case it's not obvious, this is an absurdly terrible service you should never use. Here is some free software that accomplishes the same task, which is almost surely not more likely to give your password to third parties than just typing it on the same machine would: echo $(shuf --random-source=/dev/urandom -n 6 /usr/share/dict/words)
Well, except that even most HNers won't immediately grok your command-line example, not to mention most of the people in my family or any family. It's educational at least, and $2 is not much to pay for an education about how not to use your grandchild's name and birthdate as a password. Not to mention it's awesome that an 11 year old girl is dabbling in cryptography already. I pay $2 for lemonade at a lemonade stand…
That's a fairly damning outlook you have on "most HNers".
In case it's not obvious, this is an absurdly terrible service you should never use. Here is some free software that accomplishes the same task, which is almost surely not more likely to give your password to third parties than just typing it on the same machine would: echo $(shuf --random-source=/dev/urandom -n 6 /usr/share/dict/words)
Well, except that even most HNers won't immediately grok your command-line example, not to mention most of the people in my family or any family. It's educational at least, and $2 is not much to pay for an education about how not to use your grandchild's name and birthdate as a password. Not to mention it's awesome that an 11 year old girl is dabbling in cryptography already. I pay $2 for lemonade at a lemonade stand…
If no - that's a wrong kind of education we have here.
Athough, if customers receive a package with "here's your password, but don't ever use it - see, it was compromised; take this dice instead, check its fairness and generate your own password!" then it's great.
I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
Entropy is what matters in the end. 30 random characters will have approximately 185.7 bits of entropy. With Diceware and the 7776 entry wordlist, that's 14 words to match it. Although 8-9 words is sufficient for most uses.
Instead, consider this: right now, people just don't care about the security of their passwords. Part of this might just be the "psychology of free": people don't see any reason to upgrade from what they're doing if it doesn't seem like the "upgrade" is at all scarce.
So, what if "actually secure" passwords really did cost money? Maybe people would be willing to use (or even memorize) a 10-character string of letters and symbols if it cost them $10 to generate?
I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
If /dev/urandom is seededed/used properly, then it will be good enough for passwords. The by-hand method is also good if your dice are fair.
> + I thought real words were really bad in a password. Is the idea here that, with six words from these lists, the possible combinations are so great that the trade off is worth it because the password is memorable? That seems suspicious to me because you're essentially giving the cracker the list of possible passwords. Though that list may be quite long, it's still a list. Right?
Well, by using only characters (and under a certain length, say 100 chars), you already have a list, so whatever you do, there is a finite number of valid passwords. The 6-word strategy is actually quite good. (I use this method for some passwords).
The Arch Linux /usr/share/dict/british has 123398 words.
123398 ^ 6 = 3530601691883345409045950707264 possible passwords
log(3530601691883345409045950707264) / log(2) is about 101.5 bits of randomness.
Given 86 possible characters and a 14 character password (which you may not be able to remember), there are 1210537694726365245693116416 possibilities, which gives about 90 bits of randomness.
> + These can't be better than the 30 character passwords I generate with 1Password, right? Unless there's a bug in 1Password... Maybe that's part of the point.
Randomly generated passwords using all characters have a fatal flaw: one cannot easily remember them. If they're just being saved in a password manager, they are good, but you probably want a master password that you can remember, which is a good use case for these.
In case it's not obvious, this is an absurdly terrible service you should never use. Here is some free software that accomplishes the same task, which is almost surely not more likely to give your password to third parties than just typing it on the same machine would: echo $(shuf --random-source=/dev/urandom -n 6 /usr/share/dict/words)
I guess, the service is for people, that already shrugged away, when they saw "echo" and totally collapsed with the "$(".