Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don't Store Passwords, Generate Them When Needed

16s.us

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Don't Store Passwords, Generate Them When Needed

#11

Post by kylemaxwell »

guygurari wrote: post #8
kylemaxwell wrote: post #5

Earlier quoted context omitted.

Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols. You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".

I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, si…

I'd have to think more about this particular tool, but I remember seeing some calculations that passphrases have greater total entropy than random passwords, even if it takes more characters to get the same amount of entropy.

Generally speaking, I go with the mnemonics, myself, rather than something like this.

Re: Don't Store Passwords, Generate Them When Needed

#12

Post by keyle »

theootz wrote: post #7
keyle wrote: post #3

I'm confused. Can I get a real-world example out of this?

I think the idea is that you remember a pass phrase, and the encryption type...at which point the program spits out a large hash string. The hash string gets used as your password wherever you need it, but all you need to remember is the pass phrase.

Ok, thanks for that. But as a User, why should I care? This would p*ss me right off.

Re: Don't Store Passwords, Generate Them When Needed

#13

Post by ars »

kylemaxwell wrote: post #11
guygurari wrote: post #8

Earlier quoted context omitted.

I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, si…

I'd have to think more about this particular tool, but I remember seeing some calculations that passphrases have greater total entropy than random passwords, even if it takes more characters to get the same amount of entropy. Generally speaking, I go with the mnemonics, myself, rather than something like this.

There are about 50,000 commonly used words in English.

That means that each word has an entropy of about 15.6 bits. (Probably less since some words are far more common than others.)

Using a typical 4 word phrase gets you about 62 bits of entropy.

In contrast a password can select from a set of about 72 characters. i.e. 6.1 bits per letter. Using an 10 character password gets you about 61 bits of entropy.

So they seem reasonably comparable.

It would be nice to redo the calculation while accounting for how common each word is, and also that special characters are used less often in passwords.

Re: Don't Store Passwords, Generate Them When Needed

#14

Post by asfsdfljlkjf »

guygurari wrote: post #8
kylemaxwell wrote: post #5

Earlier quoted context omitted.

Generally speaking, it's easier to remember a sentence that makes sense to you than an arcane sequence of letters, numbers, and symbols. You can even this up, of course, with mnemonics and such, but a sentence like "I have got to get me one of THESE!" has less "mental entropy" than "aem1eePe{a".

I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, si…

Passwords are not "security by obscurity".

Re: Don't Store Passwords, Generate Them When Needed

#15

Post by guygurari »

asfsdfljlkjf wrote: post #14
guygurari wrote: post #8

Earlier quoted context omitted.

I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, si…

Passwords are not "security by obscurity".

No. The difference between passwords and this is.

Re: Don't Store Passwords, Generate Them When Needed

#16

Post by noahl »

asfsdfljlkjf wrote: post #14
guygurari wrote: post #8

Earlier quoted context omitted.

I'd say an "easy-to-remember sentence" also has lower (actual) entropy than "an arcane sequence of letters, numbers, and symbols". If an attacker knows you're using this password-generation system, she will probably try brute-forcing your passphrase, not the password it generates. I don't see how this is any more secure than having a normal password -- it's just security by obscurity. And in some sense it's worse, si…

Passwords are not "security by obscurity".

The "obscurity" is the idea that an attacker would not know that you were generating your passwords by SHA-1 hashing a passphrase.

If the attacker did not know that, they could only brute-force your account by trying every possible string of characters, which is fine, because there are a lot of those. If, however, they knew what you were doing, then they could generate a list of likely-seeming passphrases, hash those, and try those hashes as passwords. If there are fewer likely passphrases than there are strings of characters, this shrinks their search space. Also, once they know you're using passphrases, they might also know that some phrases are much more likely than others, so they could try those first. This would give them a good chance of finding your password even more quickly.

Re: Don't Store Passwords, Generate Them When Needed

#17

Post by igrekel »

I actually do something similar but far simpler that I can do mentally.

I am still screwed by some passwords I rarely use because either

It a password that needs to be changed regularly and I forget where I am in the sequence.

The app had stupid requirements like the password has to be exactly 8 characters. Of course I truncate the generated string but never remember its truncated when I come back.

Re: Don't Store Passwords, Generate Them When Needed

#19

Post by 3pt14159 »

Here is what I do:

  require 'digest/sha1'
  puts "doubly troubly"
  thing = gets.chomp
  base = Digest::SHA1.hexdigest(Digest::SHA1.hexdigest(thing))
  puts base
  puts base[0..3] + "^!!^E" + base[4..-1]
  puts base[0..3] + "^!!^E" + base[4..6]
  puts base[0..3] + "^!!^E"
For any site I input the domain (so "zach.tumblr.com" + my_salt would be inputed) then I copy one of the four outputs based on what security level I think the site deserves. THEN (and most critically) I add a password that rotates key characters based on factor X of the site. Think about this like a normal password, but it changes.

I then expose this little piece of code on every one of my computers as well as on a protected server that lives only on an IP.

I 100% agree with this article, but I have my own system and it works well.

Re: Don't Store Passwords, Generate Them When Needed

#20

Post by eli »

3pt14159 wrote: post #19

Here is what I do: require 'digest/sha1' puts "doubly troubly" thing = gets.chomp base = Digest::SHA1.hexdigest(Digest::SHA1.hexdigest(thing)) puts base puts base[0..3] + "^!!^E" + base[4..-1] puts base[0..3] + "^!!^E" + base[4..6] puts base[0..3] + "^!!^E" For any site I input the domain (so "zach.tumblr.com" + my_salt would be inputed) then I copy one of the four outputs based on what security level I think the sit…

You might as well switch that to a proper HMAC. Check out HMAC::SHA1.digest
Post reply on HN