> written by hand, sent by mail
So now it's a password known only to you, the girl and the US government: http://www.nytimes.com/2014/10/28/us/us-secretly-monitoring-...
An 11-year-old is selling cryptographically secure passwords for $2 each
21–30 of 37 posts
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#22I totally bought a password and it was the best $2 I spent all weekend. I have no intention of using it, but more of a pat on the back telling her to "keep it up" and that people approve. Last thing she needs is telling her she's doing the wrong thing here.
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#23Organic, artisanal secure passwords. Worth the extra coin in my opinion.
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#24I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
DICEWARE is a list of 7776 words. Each word is indexed by a five digit number. The five digit numbers are obtained by rolling 5 six sided dice. (11111 through to 66666).
When it started a 5 word list was recommended. Now a 7 word list is recommended.
Imagine a word list where all the words are lower case, and don't use any special characters. And our passphrase has 7 words, each separated by a single space, with no extra special characters or numbers. And also our attacker knows our wordlist and our passphrase rules.
We have a phrase that is one of 7776^7 different phrases. This list is too long for a dictionary attack.
It's really weak if we have 4 words or less.
Ideally you'd have a long strong passphrase to open a password safe.
It'd be great if people could invent really good tokens instead of passwords.
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#25I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
> I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that ... I thought real words were really bad in a password.
A comment by "Hat Monster" on Ars explains why passwords generated using Diceware are secure:
If you know your target is using a Diceware password, that is, you know the format is "english word, english word, english word, english word" you'd think it could have little entropy.
Assuming that all entropy is only in the password, and the attacker knows exactly how you generated it, using which word list, and how many words long it is, this means each word, generated by 6^5 combinations, has 12.9 bits of entropy. Six words is 77 bits.
2^77 is large enough that a brute force attack on it at 1 trillion guesses per second (Snowden) would still take 151 trillion seconds, or 2.7 million years.
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#26I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
Obligatory XKCD answer:
https://xkcd.com/936/
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#27I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
Words are not bad because they're words. They're bad because humans select them predictably. Entropy is what matters in the end. 30 random characters will have approximately 185.7 bits of entropy. With Diceware and the 7776 entry wordlist, that's 14 words to match it. Although 8-9 words is sufficient for most uses.
Even properly selected, words are bad at "entropy per character". However, in most cases what matters is memorability rather than length. Words are pretty good for that, provided (as you note) you select the words well.
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#28I don't really understand why this is even theoretically supposed to be a good method of making a password. I wish the article tried to explain that. Here are a few questions I have: + I understand that the pseudo-randomness of a computer is often accidentally way less random than the programmer thinks. So, the by-hand nature of these passwords seems like an advantage, all else being equal. Right? + I thought real wo…
DICEWARE is a list of 7776 words. Each word is indexed by a five digit number. The five digit numbers are obtained by rolling 5 six sided dice. (11111 through to 66666). When it started a 5 word list was recommended. Now a 7 word list is recommended. Imagine a word list where all the words are lower case, and don't use any special characters. And our passphrase has 7 words, each separated by a single space, with no e…
> It'd be great if people could invent really good tokens instead of passwords.
U2F which the new Yubikeys supports?
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#29The bit they don't tell you is she keeps a copy and sells those passwords, with mailing address, for $20 each ...
Re: An 11-year-old is selling cryptographically secure passwords for $2 each
#30Organic, artisanal secure passwords. Worth the extra coin in my opinion.
Organic and artisanal, yet 100% hippie and hipster free! She's squared the circle, that's so awesome!