Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

141–150 of 299 posts

Re: Xkcd Password Generator

#141

Post by kragen »

burgerbrain wrote: post #131
billybob wrote: post #97

Example generated phrase: "married greatly snake battle" These phrases would be easier to remember if they made grammatical sense. Like Chomsky's famous "colorless green ideas sleep furiously" - the words relate to each other grammatically, even though it makes no sense. Imagine memorizing "married greatly snake battle" vs "married snakes battle greatly." I think the latter is easier.

Entropy would take a serious hit if you did that.

Not necessarily. If only one-fourth of all English words are grammatical after an average prefix, then you lose two bits of entropy off each word after the first. I suspect that the actual situation is not as bad as that. You might end up using "uncommon" words like "deceased", "advent", "fearful", and "ram" to compensate, instead of more common words like "strongly", "contains", "afterwards", and "corporate", but that doesn't seem like a major loss to me.

Re: Xkcd Password Generator

#143

Post by ghshephard »

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

Very few sites have a short max password length. I use 1password, and of the 63 sites I've stored passwords, all but 2 allow 25 character password lengths. Ironically, my Bank only allows me 15 characters.

I haven't typed a password in 3+ months - don't know what any of mine are anymore, so I find typing is no longer an issue.

Re: Xkcd Password Generator

#144

Post by kragen »

GFischer wrote: post #123

The link posted on the article merits a submission by itself: "The science of password selection" (a breakdown of common passwords by selection practices, as taken from public leaks) http://www.troyhunt.com/2011/07/science-of-password-selectio... In short, passwords are chosen from: People names: this includes a list of about 26,000 common first and last names. Place names: this is everything from towns to states to…

Is it possible that the breached Sony passwords he was analyzing may have been cracked with dictionary attacks? Maybe the reason only 1% of the passwords had a non-alphanumeric character was that the crackers mostly didn't crack the passwords that had any non-alphanumeric characters.

Re: Xkcd Password Generator

#146

Post by hm2k »

pavel_lishin wrote: post #48
hm2k wrote: post #29

What about sites that don't allow spaces? I know hotukdeals.com only allows [a-zA-Z0-9] which sucks.

Leave the spaces out..?

That's not what is proposed here though.

The point is that one size does not fit all at the moment.

I guess developers need to change the way they handle passwords.

Re: Xkcd Password Generator

#147

Post by dpark »

kragen wrote: post #138
dpark wrote: post #61

Earlier quoted context omitted.

These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago. With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at…

It turns out that you are mistaken. Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-... That gives you 27 bits of entropy. The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences. That gives y…

That's an interesting analysis. I can't really see any major deficiencies with it.

On the plus side, a sentence is probably going to be easier to remember than 4 random words. Personally, I draw some of my "high-security" passwords from literature, but then I modify the case and do the "leetspeak" character substitution, so a naive sentence attack would not work. A more clever one might, though.

Re: Xkcd Password Generator

#148

Post by dkokelley »

I still sense a problem. While these passwords ARE easier to remember, there is still the security flaw that most people reuse passwords. A key-logger or shoulder-surfer could snag this (or a website could store your password in plaintext and be compromised) and then it's game over. Password managers are the future. They can memorize unique passwords of any length and complexity for every website you use, and they can store the passwords with very strong encryption with 1 key that is memorized. That key is where a password like 'correcthorsebatterstaple' could be effectively used.

Re: Xkcd Password Generator

#149

Post by epscylonb »

This kind of misses the point.

A password doesn't necessarily need to be something that is easy to remember. It just needs to be a unique token that is easy for you personally to present when needed.

I currently use a keepass file stored in my dropbox folder. I am not certain what the silver bullet to online authentication will look like. However I suspect it may not require you to remember more than one secure password, perhaps not even that.

Trust online is hard though, looking at the problems establishing trust online reminds me how clever human beings are, we sometimes make mistakes but we are pretty good at evaluating trustworthiness in the real world.

Re: Xkcd Password Generator

#150

Post by bryanlarsen »

Lexarius wrote: post #62
colanderman wrote: post #43

Earlier quoted context omitted.

Don't forget sites that require: "your password MUST contain at least one number, one uppercase letter, and one of the following characters: !, @, #, or $, but not %, ^, &, or *". I slap my forehead at how counterproductive these requirements are.

This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters). If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.

The requirement for many of my website is simply that it "must not consist solely of lowercase letters". (as well as a minimum length).
Post reply on HN