Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

171–180 of 299 posts

Re: Xkcd Password Generator

#171

Post by IgorPartola »

parfe wrote: post #169
IgorPartola wrote: post #66

Put this in your .bashrc: function rpass() { strings /dev/urandom | grep -o '[[:alnum:]\/!@#$%^&*() ,.,{}]' | head -n $1 | tr -d '\n'; echo } Then run $ rpass 16 and get a 16 character random password with a fairly high entropy. Then just use a service like LastPass or a solution like KeePassX or even a single GPG-encrypted file to store your passwords. Problem solved. Passwords are evil. Most of them should be treat…

1000? Try 600 million passwords a second. http://www.elcomsoft.com/lhc.html

80^16/(600 x 10^6)/(365 x 24 x 3600) = 10^14 years.

Re: Xkcd Password Generator

#172

Post by kragen »

gjm11 wrote: post #157
kragen wrote: post #141

Earlier quoted context omitted.

Not necessarily. If only one-fourth of all English words are grammatical after an average prefix, then you lose two bits of entropy off each word after the first. I suspect that the actual situation is not as bad as that. You might end up using "uncommon" words like "deceased", "advent", "fearful", and "ram" to compensate, instead of more common words like "strongly", "contains", "afterwards", and "corporate", but th…

For what it's worth, Google finds more hits for "fearful" than for "afterwards" and more for "ram" than for "corporate". ("Strongly" and "contains" do beat "deceased" and "advent", though. And yes, many of the hits for "ram" are really for "RAM".)

My frequencies are from this word frequency list from the British National Corpus: http://canonical.org/~kragen/sw/wordlist

Re: Xkcd Password Generator

#174

Post by ScottBurson »

kragen wrote: post #138
dpark wrote: post #61

Earlier quoted context omitted.

These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago. With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at…

It turns out that you are mistaken. Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-... That gives you 27 bits of entropy. The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences. That gives y…

The attack you describe is easy to defeat by making a small modification to the selected sentence.

Re: Xkcd Password Generator

#175

Post by artmageddon »

eykanal wrote: post #96
eLod wrote: post #82

Earlier quoted context omitted.

i think you are missing the point: passwords should be hard to guess first and should be easy to remember second. the former is the stronger need. let's say there are 500.000 english words you are choosing from and you use 4 words. that gives you 500000^4 possibilities. let's assume the words averages about 5 characters, so we will compare this to a 20(=4 words * 5 characters) character long password made of 26 types…

Don't forget spaces. And Poland. Another point is that letter placement within words is significantly non-random. By intelligently choosing which letters to try in each position, the hacker could at the very least minimize the number of tries by an order of magnitude for the first word.

I probably shouldn't announce, in a forum, that using Don't Forget About Poland! as a passphrase seems like an awfully tempting for someone like me :)

(American by birth, Polish by heritage)

Speaking of the example I just presented, how much more effective would it be to include special characters within these long passphrases? Obviously the goal is to be able to remember them, but surely most if not all of us, are already using special characters for our passwords.

Re: Xkcd Password Generator

#176

Post by MichaelGagnon »

ScottBurson wrote: post #168
gjm11 wrote: post #154

Earlier quoted context omitted.

Be aware that adding to the length simply by taking more of the lyrics adds very little entropy. If you're trying "Oh say can you see" then it doesn't take a lot of extra bits also to try "Oh say can you see by the dawn's early light what so proudly we hailed at the twilight's last gleaming". Similarly, extended passages of text -- even if they don't come from a restricted corpus like that of song lyrics -- have less…

But there's a long tail of song lyrics. If you pick something obscure, the odds of the attacker even having heard of it become very small (particularly if the attacker is from a different culture than your own). Pick something arty and incomprehensible, and the odds against someone else accidentally stringing those words together in some other context become astronomical. For instance, I'd wager no cracker has ever h…

This gets into the whole "security through obscurity" thing. Ideally, you should use a password-generation system such that if the attacker knows your pasword-generation system (e.g. lines from songs) it would still be infeasible to guess your actual password.

Thats why the 4-random-words technique is good. According to XKCD, the 4-random-words technique generates about 17 trillion passwords---all equally likely.

But even with a long tail, song-lyric passwords relies on obscurity. I imagine there are much fewer than 17 trillion songs to choose from. And if the attacker knew some information about you (say from looking at your Facebook profile or your search history) I'm sure it could drastically weed out the search space.

Re: Xkcd Password Generator

#178

Post by frosas »

How does one calculate password entropy? I deduced this one:

entropy = log2(symbols^chars)

But using 63 symbols ([a-zA-Z0-9&]) I get 65 bits for Tr0ub4d0r&3, not 28.

Re: Xkcd Password Generator

#179

Post by ubernostrum »

kragen wrote: post #138
dpark wrote: post #61

Earlier quoted context omitted.

These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago. With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at…

It turns out that you are mistaken. Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-... That gives you 27 bits of entropy. The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences. That gives y…

Of course, the flip side of this is that we're veering off into attacks where you're targeting one specific person and know a bit about how they've chosen their password.

If you want to mount such an attack, fine, but most of us are dealing with the much-more-common threat of someone who gets a file or a database of hashed passwords and wants to crack them all in one go.

Re: Xkcd Password Generator

#180

Post by ajross »

abecedarius wrote: post #177

"It's a novel idea." No, I posted about my own generator in 2005: http://darius.livejournal.com/38591.html (getting the words from Beowulf). Then Zooko or Kragen pointed out some even older system in response (I forget the name).

Compuserve was generating automatic account passwords in the early 1980's from two dictionary words and a non-alpha character in between them. Mine was "sleeve;coast". No doubt they didn't invent the trick either.
Post reply on HN