Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

71–80 of 299 posts

Re: Xkcd Password Generator

#71

Post by rmc »

Simucal wrote: post #57
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

What could the reasoning behind those requirements possibly be?

Those requirements are there for the people who try putting just their name or "password" or their 4 digit ATM PIN as their password. For very short passwords, only having alphabetical (not even alphanumeric) passwords is terrible. Those requirements are there to prevent some really stupid passwords.

Re: Xkcd Password Generator

#72

Post by Lexarius »

Simucal wrote: post #57
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

What could the reasoning behind those requirements possibly be?

Usually the symbols involved are used by SQL or some other layer, and the programmers insert the password directly into the query string because they don't know any better. This leads to SQL injection and other issues.

So rather than discovering the correct way to do things, they try to prevent you from using any characters that might be involved in an SQL injection.

In some cases the guys on the backend know what they're doing, but the requirement can still be passed down from on high from some manager who absorbed the practice from another project.

Re: Xkcd Password Generator

#73

Post by wcoenen »

Note that 44 bits of entropy is still nothing if you want protection from off-line attacks on password hashes. A couple of GPUs together can calculate a billion hashes per second, which eats through 2^44 possible passwords in only a few hours.

This was recently demonstrated when the mtgox password database was compromised.

edit: but this shouldn't be a problem if the password is properly hashed with bcrypt or some other scheme with a work factor.

Re: Xkcd Password Generator

#74

Post by ErrantX »

bnegreve wrote: post #59
ErrantX wrote: post #25

Earlier quoted context omitted.

> Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible). People are likely to use a standard English dictionary. In my experience (which is exactly within this field) people use a fairly tight subset of the English vocabulary. So I would be quite happy to test for a dictionary of, say, 100,000 words and be hopeful of a good hit rate (note…

You can't test 175000^4 = 937890625000000000000 passwords.

Ahem. This is why I should check my numbers, I'm told it is a 17,500 word dictionary (and we check 3 re-combinations). Sorry about that :S

Re: Xkcd Password Generator

#75

Post by kijinbear »

drcode wrote: post #60
zobzu wrote: post #54

Earlier quoted context omitted.

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

Incorrect: It's 171k^4 and 255^8. (which works out to 8.55E20 and 1.78E19)

Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15.

I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.

Re: Xkcd Password Generator

#76

Post by pak »

drcode wrote: post #60
zobzu wrote: post #54

Earlier quoted context omitted.

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

Incorrect: It's 171k^4 and 255^8. (which works out to 8.55E20 and 1.78E19)

Yep, and that's assuming 8 random bytes from extended ASCII. The other point of the article was that nobody actually makes a password from random characters because words are easier to remember. And I think it's disingenuous to suppose people will enter alt-codes and that nonprintable characters would be allowed, so assuming MENSA-quality users with internal random number generators, we get 95^8 ~= 6.6E15, a clear loss of entropy.

Re: Xkcd Password Generator

#77

Post by dpark »

Simucal wrote: post #57
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

What could the reasoning behind those requirements possibly be?

They're trying to force users to use those characters in an attempt to enlarge the space passwords are drawn from. It doesn't work very well, of course. Instead of "password", you just get "Password1!". That said, I might make the same choice (for short passwords) if I were implementing password policy.

Edit: If you meant the "but not %, ^, &, or *" requirement, that's an indication that the devs don't know how to use prepared statements or at least escape properly.

Re: Xkcd Password Generator

#78

Post by dendory »

If you look at the source, their word list contains around 1600 words. That is just no where near enough. Using this would give you a very easy to crack password. You need to make up your own passwords with words you come up with.

Re: Xkcd Password Generator

#79

Post by nikcub »

as a bash alias:

  word_pass() {
      cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo 
  }
then:

  $ word_pass
  corticifugally tetraploidy democrat vibrionic
(if you notice how this works, you can see that it isn't super-efficient, but it works)

Re: Xkcd Password Generator

#80

Post by CWuestefeld »

Khao wrote: post #67

I remember wanting to sign up on a website that had the worst password "feature" ever : you typed your password in a plain textfield, and once you clicked away it was changed to a password field. Seeing as how this "feature" was on the main page I decided never to use this service and sent the website an e-mail saying that their password field is not clever but instead is a big fat counter-security measure. Edit : I…

I think that's fantastic.

1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone.

2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that.

So it looks like all upside, with no cost (when used only in appropriate contexts).

Post reply on HN