Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

101–110 of 299 posts

Re: Xkcd Password Generator

#101

Post by adnam »

burgerbrain wrote: post #35
adnam wrote: post #6

Such a password scheme provides much less than 44 "bits" of entropy. Considering the use of 4 randomly chosen words from the c.170000 english words in general use, means we can guess the paraphrase in around 2^22 tries - even less than "Tr0ub4d0r3&". EDIT: I'm totally wrong, it's more like 2*10^22 ... oops!

There is no need for scare quotes around bits . The term is being used in a technically correct fashion. https://secure.wikimedia.org/wikipedia/en/wiki/Bit#Informati...

Err, yes thanks. I was trying to emphasise the fact that the multiplier of entropy is not the "bit", but the "word" (in the linguistic, rather than the computer architecture sense)

Re: Xkcd Password Generator

#102

Post by jobu »

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Also annoying is that a lot of sites require gibberish. Apple requires at least one uppercase, one lowercase, and one number. Some sites require a symbol as well.

Re: Xkcd Password Generator

#103

Post by ddlatham »

eLod wrote: post #82
ddlatham wrote: post #23

A lot of comments here seem to be missing the point. The main point is to use passwords that give you the most "bang for the buck" in the sense of adding the most bits of entropy for the least difficulty of remembering. Adding an extra number, or punctuation, or certain numbers of repetitions generally adds only a little bit of entropy for a significant cost in additional challenge to your memory. Our minds are well…

i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need. let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types…

I'll grant you that it's more important to have a password be difficult to guess, but that doesn't obviate the importance of it also being easy to remember. Even better, let's look for password schemes that are harder to guess and easier to remember at the same time.

It's easy to compare the entropy of two schemes as you're doing in your comment, but it's more difficult to objectively claim which is easier to remember. You argue that a random sequence of 12 characters is easier to remember than 4 words. If so, then I'd agree it would be a better scheme. However, I don't think that's the case. To really settle the argument, we should do some experiments - maybe someone already has?

Here's some examples I used a generator to create:

gangster insert madden quartic

overlong cage figurine hardship

trimmer wholly movie nadir

Bt].iu@0Soc*

Vf+pIW;C>\vp

'.}]Ba,g%@vI

Which do you think are easier to remember?

Re: Xkcd Password Generator

#104

Post by eru »

scythe wrote: post #46

You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.

Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast. E.g. suppose English and German have the same number of words, then using both only gives you one more bit per word.

(Actually, slightly less since some words exist in both languages. Like `hell'.)

Re: Xkcd Password Generator

#105

Post by adr_ »

nikcub wrote: post #79

as a bash alias: word_pass() { cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo } then: $ word_pass corticifugally tetraploidy democrat vibrionic (if you notice how this works, you can see that it isn't super-efficient, but it works)

Using shuf, my favourite, rarely used gnu textutil.

    shuf /usr/share/dict/words|head -4|tr '\n' ' ';echo

Re: Xkcd Password Generator

#106

Post by dfxm12 »

CWuestefeld wrote: post #80
Khao wrote: post #67

I remember wanting to sign up on a website that had the worst password "feature" ever : you typed your password in a plain textfield, and once you clicked away it was changed to a password field. Seeing as how this "feature" was on the main page I decided never to use this service and sent the website an e-mail saying that their password field is not clever but instead is a big fat counter-security measure. Edit : I…

I think that's fantastic. 1: what purpose do the stupid asterisks serve, anyway? I understand them on an ATM machine, but not on my desktop PC or phone. 2: Very frequently (like, maybe 50% of the time) when trying to type a password on my phone, I miss the little "key" and mistype, but can't see that I did. I have to make multiple tries at entering the password. This feature would prevent that. So it looks like all u…

1. Shoulder surfing a password is way easier than other forms of cracking. Sure, you might not think people are looking at you as you type your password, but then this becomes a crime of opportunity...

2. There are technological ways around this, like finding a bigger keyboard for your phone, using password management software, imploring the website to make an app, practicing typing, etc. Also, BB/iOS/Android all show the most recent character you typed in a password field. Many soft keyboards give feedback about the most recent character you types as well.

I'm fine with my password fields being obfuscated.

Re: Xkcd Password Generator

#108

Post by IgorPartola »

yuvadam wrote: post #91
IgorPartola wrote: post #66

Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…

Actually LastPass has this option built-in. It can generate a strong password in-form and directly save it to your password vault. Very useful.

Yes, but I prefer to generate the passwords on my own. I also use this to generate random passwords for root accounts (sudo FTW), etc.

Re: Xkcd Password Generator

#109

Post by bnegreve »

eru wrote: post #98
nakkiel wrote: post #20

This might come in handy: shuf -n4 /usr/share/dict/words | tr '\n' ' '

If you allow multiple occurrences of the same word, you can get slightly higher entropy while making the passwords potentially even easier to remember. echo $(for i in 1 2 3 4; do shuf -n1 /usr/share/dict/words; done) (Sorry, I'm not very good at bash, so this loop is probably not idiomatic.)

for i in `seq 1 4`; :)

Re: Xkcd Password Generator

#110

Post by nikcub »

adr_ wrote: post #105
nikcub wrote: post #79

as a bash alias: word_pass() { cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo } then: $ word_pass corticifugally tetraploidy democrat vibrionic (if you notice how this works, you can see that it isn't super-efficient, but it works)

Using shuf, my favourite, rarely used gnu textutil. shuf /usr/share/dict/words|head -4|tr '\n' ' ';echo

ye it isn't on OS X

just the same, sort -R is GNU only and not POSIX

Post reply on HN