Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

111–120 of 299 posts

Re: Xkcd Password Generator

#111

Post by Tharkun »

burgerbrain wrote: post #15
pilif wrote: post #11

Assuming that this method for generating passwords gets popular enough, brute force tools will begin to create an optimized attack for these passwords. As there are so little words available, if I were to write a brute-forcing tool, I would try combinations of four words in my wordlist once I failed with my one-word-dictionary attack before I start trying out all characters. But all is not lost: Either use more words…

https://secure.wikimedia.org/wikipedia/en/wiki/Diceware Properly executed, this will protect you against brute force attacks. No need to do nonsense like adding more spaces. Of course XKCD botched it and said an inadequate minimum length... Notable quote from the article: "This level of unpredictability assumes that a potential attacker knows both that Diceware has been used to generate the passphrase, the particular…

Here's how I use diceware: 1) throw single die to determine number of languages 2) throw dice to determine which languages (number of iterations depends on the result of #1) 3) throw dice to determine language 4) throw all dice to determine first word in language 5) repeat #3, #4 until you've reached the desired number of words

Re: Xkcd Password Generator

#112

Post by dsmithn »

cdavidcash wrote: post #86
drcode wrote: post #36

One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to all your passphrases. In this case, the salt would be a short, traditional, hard to remember password that you re-use with every xkcd style password. It would be hard to remember, but you'd only need to memorize it once. So if your personal salt is "@T#23a" yo…

You might want to read the cartoon again to see why this is useless, counterproductive advice.

If this kind of thing takes off, it will become easier for dictionary based password attacks. Using this advice would go a long way towards preventing this.

Re: Xkcd Password Generator

#113

Post by Periodic »

wisty wrote: post #30

How about (NOT SECURE YET, IT NEEDS MORE ENTROPY): from nltk.corpus import wordnet as wn all_animals = set() def add_to_set(animal): all_animals.add(animal.name.split('.')[0].replace('_',' ')) for child in animal.hyponyms(): add_to_set(child) add_to_set(wn.synset('animal.n.01')) all_animals = list(all_animals) actions = ['ate','chased','killed','fought','kissed', 'talked to','hated','loved','ambushed','fled'] # can a…

Completely random strings of words can be hard for me to remember, but something like, "the {adjective1} {animal1} {verb} the {ajective2} {verb2}" would be much easier for me to remember because the words relate to each other ways I already understand.

I expect we can get some fairly high entropy from just simple schemes like this.

However, the length of the password can be a real pain if you have to type it often, even once a day.

Re: Xkcd Password Generator

#114

Post by andyking »

colanderman wrote: post #43
nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

I have a couple of domains registered with 123-reg.

To prevent unauthorised access to your account your password must contain 8 characters.

Wait, what? They're right, too. You can't have 7 characters and you can't have 9.

Re: Xkcd Password Generator

#115

Post by xyzzyb »

cdavidcash wrote: post #86
drcode wrote: post #36

One slight addition to the xkcd password scheme that would add another order of magnitude of security would be to have your own personal "salt" that you add to all your passphrases. In this case, the salt would be a short, traditional, hard to remember password that you re-use with every xkcd style password. It would be hard to remember, but you'd only need to memorize it once. So if your personal salt is "@T#23a" yo…

You might want to read the cartoon again to see why this is useless, counterproductive advice.

Yes, but the salt could also be useful for sites that require passwords to include a number, a non alphanumeric character, etc.

Re: Xkcd Password Generator

#116

Post by julianpid »

I find the idea incredibly stupid. If I know someone who used that precise generator to produce his password. Then I know that the generator has less than 2000 words in the dictionnary. It then takes me only a few minutes to guess his password, rather than 550 years.

Conclusion: Don't ever use this password generator, write you own, and tell no-one about it.

Re: Xkcd Password Generator

#117

Post by wgx »

andyking wrote: post #114
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

I have a couple of domains registered with 123-reg. To prevent unauthorised access to your account your password must contain 8 characters. Wait, what? They're right, too. You can't have 7 characters and you can't have 9.

Yes a friend was complaining about that recently.

It's a bruteforcer's dream.

Re: Xkcd Password Generator

#118

Post by AdamTReineke »

dsmithn wrote: post #112
cdavidcash wrote: post #86

Earlier quoted context omitted.

You might want to read the cartoon again to see why this is useless, counterproductive advice.

If this kind of thing takes off, it will become easier for dictionary based password attacks. Using this advice would go a long way towards preventing this.

Easier, yes, but not easy. A dictionary attack on 4 words is the same as brute forcing 4 letters except now instead of just 26 letters there are thousands. 2000^4 vs 26^4 = 35,000,000% more to check.

Re: Xkcd Password Generator

#119

Post by scythe »

eru wrote: post #104
scythe wrote: post #46

You could probably get a few more bits of entropy kind of easily if you use words from other languages. This doesn't help the monolingual among us but it's great for me.

Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast. E.g. suppose English and German have the same number of words, then using both only gives you one more bit per word. (Actually, slightly less since some words exist in both languages. Like `hell'.)

>Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast.

Well, sure -- but once you're at around two or three languages, you get to imagine that the attacker doesn't know what languages you're using. If I use English, Japanese, and Spanish, I can figure on the attacker needing to check the Germanic (English, Dutch, German), Romance (Spanish, French, Italian), and Asian (Japanese, Chinese, Korean) languages at a minimum.

Jargon helps too, and proper names. "dijkstra bicycle entonces boojum daihinmin"

Re: Xkcd Password Generator

#120

Post by tgrass »

This still creates a false sense of security since it seems (and I stress seems) to implicitly suggest you can use the same password on every site (I assume this since the argument for its use is the ease of remembering). If one site you visit handles passwords in plain text and it has your email, upon a breach all your accounts are effectively compromised.
Post reply on HN