Xkcd Password Generator • Hacker News Board

Re: Xkcd Password Generator

#81

Post by nollidge » Thu, Aug 11, 2011, 2:45 PM UTC

jsulak wrote: post #16

I prefer using a program like Password Safe ( http://passwordsafe.sourceforge.net/ ), and use a safe password that's a long sentence (with punctuation). Then I can use arbitrarily long and complex passwords for all my accounts, and not have to worry about memorizing them individually. The password safe can even be synced across computers using Dropbox.

I prefer KeePass simply because it's got implementations on multiple OSs, as does Dropbox (to sync the password database file). So I've got it on my iMac, Android phone, Windows laptop, and Windows work PC.

Re: Xkcd Password Generator

#82

Post by eLod » Thu, Aug 11, 2011, 2:45 PM UTC

ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need.

let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types of character (english alphabet, not using numbers and other special characters), that gives you 26^20 possibilities. and 26^20 - 500000^4 ~= 2x10^28, or put it this way: (26^20) / (500 000^4) = 318 850.382..

i know a random sequence of 20 characters are very hard to remember, but 500.000 is an overestimation too. let's say we use special symbols too (50 characters) and the word dictionary has 100.000 words. (50^12) / (100 000^4) = 2.44 so we can say it is better to have a 12 character long password (made of alphanums + symbols) than 4 random word concatenated (i think 12 is somewhat a 'standard' for 'sensitive' passwords). and i would argue that on the long term multiple concatenated passwords are very hard to remember. i'm not saying this is a terrible approach, just not the silver bullet to the 'password problem' (which xkcd never claimed of course, and for 'non sensitive', 'reused'/'throwaway' passwords it may be a viable option).

edit: and i forgot about case sensitivity too.

Re: Xkcd Password Generator

#83

Post by drcode » Thu, Aug 11, 2011, 2:45 PM UTC

kijinbear wrote: post #75

drcode wrote: post #60

Earlier quoted context omitted.

Incorrect: It's 171k^4 and 255^8. (which works out to 8.55E20 and 1.78E19)

Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15. I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.

Right- I was just correcting the dude's math :-)

Re: Xkcd Password Generator

#84

Post by enduser » Thu, Aug 11, 2011, 2:45 PM UTC

Lexarius wrote: post #72

Simucal wrote: post #57

Earlier quoted context omitted.

What could the reasoning behind those requirements possibly be?

Usually the symbols involved are used by SQL or some other layer, and the programmers insert the password directly into the query string because they don't know any better. This leads to SQL injection and other issues. So rather than discovering the correct way to do things, they try to prevent you from using any characters that might be involved in an SQL injection. In some cases the guys on the backend know what th…

If anyone knew what they were doing the uncrypted password would be nowhere near a SQL statement.

Re: Xkcd Password Generator

#85

Post by ddlatham » Thu, Aug 11, 2011, 2:46 PM UTC

zobzu wrote: post #54

ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

171K words in the english language 4 words no spaces 171k^4 vs 255^8 for a 8 char pass

First, that's still beside the point. You shouldn't evaluate a password scheme solely by entropy if it is a password you intend to memorize. XKCD argues that it's easier to remember 4 random words than 8 random characters.

Second, your example isn't very good because it assumes that every 8 byte character (save one) is acceptable, which is rarely the case, especially if you are trying to memorize them.

Finally, as another commenter pointed out, you've got your math wrong, and even your example has more entropy for the words than the characters.

Re: Xkcd Password Generator

#86

Post by cdavidcash » Thu, Aug 11, 2011, 2:55 PM UTC

drcode wrote: post #36

One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to all your passphrases. In this case, the salt would be a short, traditional, hard to remember password that you re-use with every xkcd style password. It would be hard to remember, but you'd only need to memorize it once. So if your personal salt is "@T#23a" yo…

You might want to read the cartoon again to see why this is useless, counterproductive advice.

Re: Xkcd Password Generator

#87

Post by djackson » Thu, Aug 11, 2011, 2:56 PM UTC

pavel_lishin wrote: post #44

ErrantX wrote: post #10

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…

> H4ck3r N3ws H4ck3r News H4cker News Hacker News Maybe you have an excellent memory, but I'd forget this in a week. "Now let's see, is it the third 'hacker' that has the 4 AND the 3 in it? Or the 2nd?"

He's just removing the right-most letter/number swap in each iteration.

Re: Xkcd Password Generator

#88

Post by Khao » Thu, Aug 11, 2011, 2:57 PM UTC

CWuestefeld wrote: post #80

Khao wrote: post #67

I remember wanting to sign up on a website that had the worst password "feature" ever : you typed your password in a plain textfield, and once you clicked away it was changed to a password field. Seeing as how this "feature" was on the main page I decided never to use this service and sent the website an e-mail saying that their password field is not clever but instead is a big fat counter-security measure. Edit : I…

I think that's fantastic. 1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone. 2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that. So it looks like all u…

I agree that this feature is good while working with a smartphone, but I'm pretty sure Android has a settings somewhere to always show the last letter you typed in every password field. I would be surprised if there wasn't a setting for that also on iOS.

The thing is, I think it makes perfect sense to implement this in certain situations, but at an OS or browser level, not in the website or inside an application. Passwords are something we have grown used to and we always expect them to behave the same way! If we were to change the way passwords are handled, it should be consistent across everything.

For example, browsers could implement password fields with a checkbox next to it that lets you show/hide password at your will. The fact that this website has only one setting (always show when in focus) is scaring me.

Re: Xkcd Password Generator

#89

Post by dpark » Thu, Aug 11, 2011, 2:57 PM UTC

ErrantX wrote: post #10

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…

> H4ck3r N3ws H4ck3r News H4cker News Hacker News

This is a terrible idea. It's one thing to ask a person to remember which characters they replaced in a word. It's another thing entirely to ask them to remember three different ways they swapped characters. This is a recipe for having to brute-force your own password. It's also still not as secure as you might imagine. There's very little entropy added by swapping characters (even though I do it as well), because there are very few substitutions that people make. "Hacker News Hacker News Hacker News" is nearly as secure as your convoluted 3rd passphrase, but a lot easier to remember.

The repeat-three-times thing is probably not great advice, either. If this became popular, it would be trivial to add this to brute-forcing code, and it doesn't add as much entropy as adding just one extra character.

I don't think the XKCD suggestion is actually good, either. Open a book and pick a medium-length sentence. There's your passphrase: an n-gram chosen arbitrarily from the corpus of (probably) English literature containing mixed-case and punctuation. You've got a ton of entropy there.

Re: Xkcd Password Generator

#90

Post by pbhjpbhj » Thu, Aug 11, 2011, 2:59 PM UTC

kijinbear wrote: post #75

drcode wrote: post #60

Earlier quoted context omitted.

Incorrect: It's 171k^4 and 255^8. (which works out to 8.55E20 and 1.78E19)

Actually, since you normally can't use anything but characters in the 0x20-0x7E range, the 8 char password has much less entropy: 95^8 ~= 6.63E15. I love the backtick in my passwords. If a website accepts it and doesn't give me any issues, it's a decent indicator of basic security.

>the 8 char password has much less entropy: 95^8 ~= 6.63E15 //

Most of the word usage is going to be limited though too. testyourvocab.com put the average at 27k I think. We're looking for words one can remember easily so the word pool is going to be a lot lower - 15000^4 ~= 5E16 FWIW.