Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

91–100 of 299 posts

Re: Xkcd Password Generator

#91

Post by yuvadam »

IgorPartola wrote: post #66

Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…

Actually LastPass has this option built-in. It can generate a strong password in-form and directly save it to your password vault.

Very useful.

Re: Xkcd Password Generator

#92

Post by duck »

IgorPartola wrote: post #66

Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…

If you use KeePass there is no need for the script since it will generate one for you based on rules you can set.

Re: Xkcd Password Generator

#93

Post by eru »

dendory wrote: post #78

If you look at the source, their word list contains around 1600 words. That is just no where near enough. Using this would give you a very easy to crack password. You need to make up your own passwords with words you come up with.

> You need to make up your own passwords with words you come up with.

That might have even less entropy. Why not just get a bigger dictionary? Most Unix systems even come with a dictionary.

Re: Xkcd Password Generator

#94

Post by dpark »

eLod wrote: post #82
ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need. let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types…

Are you serious? You think it's easier to remember 12 random characters than to remember four English words?

g6M;`Zt3^,d" vs selected aardvark badminton winnings

The way the human brain works, it would be at least as easy to remember 12 random words as 12 random characters.

Re: Xkcd Password Generator

#96

Post by eykanal »

eLod wrote: post #82
ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need. let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types…

Don't forget spaces. And Poland.

Another point is that letter placement within words is significantly non-random. By intelligently choosing which letters to try in each position, the hacker could at the very least minimize the number of tries by an order of magnitude for the first word.

Re: Xkcd Password Generator

#97

Post by billybob »

Example generated phrase: "married greatly snake battle"

These phrases would be easier to remember if they made grammatical sense. Like Chomsky's famous "colorless green ideas sleep furiously" - the words relate to each other grammatically, even though it makes no sense.

Imagine memorizing "married greatly snake battle" vs "married snakes battle greatly." I think the latter is easier.

Re: Xkcd Password Generator

#98

Post by eru »

nakkiel wrote: post #20

This might come in handy: shuf -n4 /usr/share/dict/words | tr '\n' ' '

If you allow multiple occurrences of the same word, you can get slightly higher entropy while making the passwords potentially even easier to remember.

    echo $(for i in 1 2 3 4; do shuf -n1 /usr/share/dict/words; done)
(Sorry, I'm not very good at bash, so this loop is probably not idiomatic.)

Re: Xkcd Password Generator

#99

Post by roc »

Khao wrote: post #88
CWuestefeld wrote: post #80

Earlier quoted context omitted.

I think that's fantastic. 1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone. 2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that. So it looks like all u…

I agree that this feature is good while working with a smartphone, but I'm pretty sure Android has a settings somewhere to always show the last letter you typed in every password field. I would be surprised if there wasn't a setting for that also on iOS. The thing is, I think it makes perfect sense to implement this in certain situations, but at an OS or browser level, not in the website or inside an application. Pas…

> "I would be surprised if there wasn't a setting for that also on iOS."

That's the default behavior for password fields in iOS. Trick is, when you have a long password it takes far too long to shift focus from the keyboard to the text field to verify each character before moving on.

I'd very much like to have a client-side show/hide button for password fields.

Re: Xkcd Password Generator

#100

Post by bnegreve »

ErrantX wrote: post #74
bnegreve wrote: post #59

Earlier quoted context omitted.

You can't test 175000^4 = 937890625000000000000 passwords.

Ahem. This is why I should check my numbers, I'm told it is a 17,500 word dictionary (and we check 3 re-combinations). Sorry about that :S

Ah ! Now, I agree that if everyone follow this advice, it's going to be fairly easy to crack every password based on a small set of simple words.
Post reply on HN