Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

61–70 of 299 posts

Re: Xkcd Password Generator

#61

Post by dpark »

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago.

With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at typing a 30-character password is pretty obnoxious, too.

In situations that allow passphrases, you don't need a password generator like this. You can grab a sentence from your favorite book and use it. e.g. "How do you do, Miss Doolittle?" That's not the best choice, but it's still got way more entropy than a standard password, probably a lot more entropy more than you'll get by choosing a 4-gram composed of words from a corpus of 2k, and it's easier to remember.

Re: Xkcd Password Generator

#62

Post by Lexarius »

colanderman wrote: post #43
nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters).

If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.

Re: Xkcd Password Generator

#63

Post by kijinbear »

scythe wrote: post #46

You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.

Some Koreans do this: they just type up some Korean words. Since most password fields only accept ASCII symbols, the password gets entered as a nonsensical string of alphabets. For example, the Korean word '비밀번호' (meaning 'password'), when typed on a standard Korean keyboard, becomes 'qlalfqjsgh'.

Re: Xkcd Password Generator

#64

Post by wcoenen »

Gullanian wrote: post #47

Once hackers realise people are using ~4 random words for a password the entropy will decrease hugely.

I think you've got it backwards: the entropy calculation here assumes that the attacker already knows the scheme. The 2^44 possible passwords are therefore a lower boundary for the entropy.

In practice the attacker must cast a wider net because he doesn't know exactly which word list you use, or if you are using a completely different password scheme. This increases the difficulty.

Re: Xkcd Password Generator

#65

Post by bnegreve »

zobzu wrote: post #54
ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

No, the single word password is based on a dictionary word with some chars replaced by other visually similar chars. That's much less than 8^255.

Re: Xkcd Password Generator

#66

Post by IgorPartola »

Put this in your .bashrc:

  function rpass() {
      strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*(),.,{}]' | head -n $1 | tr -d '\n'; echo
  }
Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved.

Passwords are evil. Most of them should be treated the way you'd treat your private SSH or SSL key. Whenever you can eliminate a password and get the user to authenticate using a third-party identity provider, you are doing them a favor.

Edit: with 80 possible characters, you get 80^16 possible passwords: 10^19 years at 1000 guesses/second.

Re: Xkcd Password Generator

#67

Post by Khao »

I remember wanting to sign up on a website that had the worst password "feature" ever : you typed your password in a plain textfield, and once you clicked away it was changed to a password field. Seeing as how this "feature" was on the main page I decided never to use this service and sent the website an e-mail saying that their password field is not clever but instead is a big fat counter-security measure.

Edit : I managed to find back what website it was : http://www.advirtus.com/ when you register it shows the password as you type it

Re: Xkcd Password Generator

#68

Post by dpark »

Lexarius wrote: post #62
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters). If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.

Wow, sanity in password requirements? Do they also avoid the silly mandatory 30-day password change?

Re: Xkcd Password Generator

#69

Post by eru »

Simucal wrote: post #57
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

What could the reasoning behind those requirements possibly be?

Covering your ass by disallowing passwords like "password".

Re: Xkcd Password Generator

#70

Post by hvs »

zobzu wrote: post #54
ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

It's actually closer to 92^8 (printable ASCII) or even 62^8 (if they only allow letters and numbers).
Post reply on HN