Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

161–170 of 299 posts

Re: Xkcd Password Generator

#161

Post by gjm11 »

nikcub wrote: post #79

as a bash alias: word_pass() { cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo } then: $ word_pass corticifugally tetraploidy democrat vibrionic (if you notice how this works, you can see that it isn't super-efficient, but it works)

DANGER: This gives no more entropy than what srand() uses, which (at least for GNU awk) is simply the current UNIX time, which (if we assume that when you generated the password is known to within one year) means only about 25 bits of entropy.

Re: Xkcd Password Generator

#162

Post by DufusM »

nakkiel wrote: post #20

This might come in handy: shuf -n4 /usr/share/dict/words | tr '\n' ' '

I don't think those words are very practical. For example, 4 consecutive runs produced:

shippon preannouncer half-hourly withgang egotize baffs chapter monolater photoengraver beachhead linguidental autoheader hazeled defloration exhumate barretries

none of which seem particularly easy to remember (or spell even).

Re: Xkcd Password Generator

#163

Post by [deleted] »

lukeschlather wrote: post #132
ErrantX wrote: post #10

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…

>H4ck3r N3ws H4ck3r News H4cker News Hacker News You can add equivalent entropy just by adding a few random special characters, a number, and a letter. Personally, I prefer to type my passwords until I remember them. Therefore, my metric is "easy to type and hard to guess." If it's easy to type, I remember it via muscle memory, which is unbelievably better than trying to remember abstract symbols.

[deleted]

Re: Xkcd Password Generator

#164

Post by nxn »

ZoFreX wrote: post #18

I would actually advise going against this advice. While it isn't a best practice, password sharing can and does happen, as does shoulder-surfing. It would take a LOT of effort to memorise my password, but a simple four word password will probably be remembered by accident. In a year's time if I piss a friend off, I don't want my Facebook password to be readily accessible in their memory. I think more people need to…

So you're advising against what appears to be a more practical and secure methodology on the basis that it's worse when you share your password? If you share your password, your exact problem is that you're sharing your password -- it's not how easy or hard the password is to remember. In fact, why does this even have any significance when the person you're sharing it with can just write it down?

Oh and if within a year's time you do not change your password, that could very well be another problem. I think you'd be better off just using easy to remember pass phrases and changing them every once in a while. Shouldn't be a problem because they are, after all, easy to remember.

Re: Xkcd Password Generator

#165

Post by benmathes »

gjm11 wrote: post #154
mortenjorck wrote: post #139

Earlier quoted context omitted.

I've started using song lyrics when given the option of an extra-long password. I can get a very long string with little effort, and it's trivial to remember. The best part is that any automated attack would have to deal with ringtone popups.

Be aware that adding to the length simply by taking more of the lyrics adds very little entropy. If you're trying "Oh say can you see" then it doesn't take a lot of extra bits also to try "Oh say can you see by the dawn's early light what so proudly we hailed at the twilight's last gleaming". Similarly, extended passages of text -- even if they don't come from a restricted corpus like that of song lyrics -- have less…

I can see your point in that the kolmogorov complexity of two lines in a song isn't much larger than one line. Similarly, 30 digits of pi and 300 digits of pi have very little difference in kolmogorov complexity.

What I don't know is if state-of-the-art password guessers are great at recognizing larger patterns in the entire canon of human knowledge. I.e. is there a "common phrases" attack that's analogous to a "dictionary attack"?

Re: Xkcd Password Generator

#166

Post by r00fus »

nmcfarl wrote: post #33

I've been using phrases and sentences as passwords for a while, and I've found that there are 2 main problems; 1) A lot of sites, still in this day and age, have max password lengths, so I still have a lot of short passwords. Usually this is bank sites and the like. 2) Password entry fields are often very short visually, and with a long password getting lost is much easier. I find I have to type them over A LOT. The…

I just use a password manager like laspass or 1password. If it has submission automation, you don't even need to type your password.

Just choose a nice strong master password.

Re: Xkcd Password Generator

#167

Post by nikcub »

gjm11 wrote: post #161
nikcub wrote: post #79

as a bash alias: word_pass() { cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"$0}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " && echo } then: $ word_pass corticifugally tetraploidy democrat vibrionic (if you notice how this works, you can see that it isn't super-efficient, but it works)

DANGER: This gives no more entropy than what srand() uses, which (at least for GNU awk) is simply the current UNIX time, which (if we assume that when you generated the password is known to within one year) means only about 25 bits of entropy.

srand in awk is platform specific. on most recent is isn't a straight call to srand().

I have another version that I use that stuffs srand but in the end I figured srand from a 250k dictionary is still better than picking words out of your head from a ~1k dictionary

Re: Xkcd Password Generator

#168

Post by ScottBurson »

gjm11 wrote: post #154
mortenjorck wrote: post #139

Earlier quoted context omitted.

I've started using song lyrics when given the option of an extra-long password. I can get a very long string with little effort, and it's trivial to remember. The best part is that any automated attack would have to deal with ringtone popups.

Be aware that adding to the length simply by taking more of the lyrics adds very little entropy. If you're trying "Oh say can you see" then it doesn't take a lot of extra bits also to try "Oh say can you see by the dawn's early light what so proudly we hailed at the twilight's last gleaming". Similarly, extended passages of text -- even if they don't come from a restricted corpus like that of song lyrics -- have less…

But there's a long tail of song lyrics. If you pick something obscure, the odds of the attacker even having heard of it become very small (particularly if the attacker is from a different culture than your own). Pick something arty and incomprehensible, and the odds against someone else accidentally stringing those words together in some other context become astronomical.

For instance, I'd wager no cracker has ever heard the song containing the line "We barter images on the matrix". And that's one of the more intelligible lines from the song in question (from a 1978 album by the little-known prog-rock group Happy The Man). Pull it up on Google and you'll see what I mean.

If you don't know the song, of course, lines from it will be about as hard to remember as randomly chosen words. But if you do know it, you have a good mnemonic.

Re: Xkcd Password Generator

#169

Post by parfe »

IgorPartola wrote: post #66

Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…

1000? Try 600 million passwords a second.

http://www.elcomsoft.com/lhc.html

Post reply on HN