Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

201–210 of 299 posts

Re: Xkcd Password Generator

#201

Post by a3camero »

Cushman wrote: post #189
Dove wrote: post #160

I find the discussion surrounding the XKCD strip alarming for the superstition it reveals about password generation. The particular theme I am alarmed by is that people seem to think that if a password looks alien, or was difficult for them to come up with, it will be hard for a machine to guess. Look, we're working with big numbers here. You need to do the math. In this thread alone, I've seen suggestions to use a c…

This should be higher up. It's scary to see people — intelligent people, I'm sure — saying things like "And that goes even higher when you add punctuation!" No, it doesn't. All of the reasonable punctuation you could add to a sentence adds only a few bits of entropy at best. It also makes the sentence harder to remember— was there a comma or not? Adding unreasonable punctuation or symbols is even worse— you get sligh…

It's certainly a "very long random string" without context but as people have pointed out above, it's actually not a very good password if people adopted this pattern widely (and you said the attacker knows this).

2000^4 = 16000000000000 possible passwords = 1.6E13 = ([A-Z] + [a-z] + [0-9] + [!@#$%^&()])^7.1ish. So, your four words from the 2000 word list are equal to a 7ish character password that looks like "Av#12GH". I'm not sure if you meant that seven characters was "very long" but I wouldn't say it is. Still a very strong password but maybe not as random as it appears to be when the pattern is known.

Re: Xkcd Password Generator

#202

Post by mtogo »

nollidge wrote: post #81
jsulak wrote: post #16

I prefer using a program like Password Safe ( http://passwordsafe.sourceforge.net/ ), and use a safe password that's a long sentence (with punctuation). Then I can use arbitrarily long and complex passwords for all my accounts, and not have to worry about memorizing them individually. The password safe can even be synced across computers using Dropbox.

I prefer KeePass simply because it's got implementations on multiple OSs, as does Dropbox (to sync the password database file). So I've got it on my iMac, Android phone, Windows laptop, and Windows work PC.

If you have an iPhone or don't want to use keepassx, you can use an online password manager like Passpack or Lastpass.

The downside is that you need to really trust the password manager, as they have all of your usernames and password.

Re: Xkcd Password Generator

#203

Post by crizCraig »

ajross wrote: post #182

I can't help but think that this is a solution to the wrong problem. The big problem with password security in the modern world really isn't that they're easy to break, but that they're pervasively reused between sites. So breaking them (for example, by reading them in plain text out of a dumb database!) in one place opens up attacks on higher value accounts. The fix, of course, is to get users to stop re-using passw…

Right, maybe if you use the first letter of the words in a sentence, like "Hey Jude, don't make it bad, take a sad song, and make it better." -> "HJ,dmib,tass,amib." Then you can add in some characters that make it different for each site without it being obvious which characters you added. I wrote a blog post on how to create different passwords for sites that are easy to remember: http://craigquiter.com/post/8668237043/creating-and-remember...

Re: Xkcd Password Generator

#204

Post by rubberbandage »

absentbird wrote: post #135

This is how I come up with passwords; I find a phrase that I can remember without too much trouble then I use the first letter of each word to make a password. Phrase: Three Rings for the Elven-kings under the sky, Seven for the Dwarf-lords in their halls of stone Password: 3RftE-kuts,7ftD-lithos Easy to remember and highly secure. I have been using this method for years. Bonus example: Four score and seven years ago…

This is the same method Apple officially recommended in their help for choosing a secure password—the example they gave was “Tnf,tfws95” (“That’s not flying, that’s falling with style”) followed by the year of Toy Story’s release (where the quote is from). I agree that it’s an excellent combo of passphrase and obfuscation. Unfortunately, their documentation now[1] gives the same kind of example that XKCD points out will be exceedingly difficult to remember correctly.

[1] http://support.apple.com/kb/HT1506

Re: Xkcd Password Generator

#205

Post by Adaptive »

pguzmang wrote: post #121

This article is math true, however, hackers no longer use brute force attacks and the most popular method is to attack a weak website like for example a not very popular blog, then if they succesfully broke it they have a password and a email account from you and if they are very lucky you have the same password for the email account, so, they got you. Therefore, nowadays it is safer to have different passwords for e…

You can add a variety of two factor authentication options to lastpass (phys OTP, yubikey).

You can also allow/disallow "offline" access to your lastpass account when using these two factor options (force second factor at all times or allow single factor if offline).

Re: Xkcd Password Generator

#206

Post by alanh »

Careful! This is only using `Math.random` and does not attempt to use `window.crypto.random` (though most browsers do not support it yet: http://jsfiddle.net/alanhogan/trUYu/) or anything that would attempt to bring real entropy into the process.

I don’t mean to fault the creator of this page, but at the same time, I would not trust this generator for important passwords, simply because you cannot know if others are getting the same 'random' results as you are.

More info on SO: http://stackoverflow.com/questions/5651789/is-math-random-cr...

PDF on the topic: http://www.trusteer.com/sites/default/files/Temporary_User_T...

> In the Javascript engines of IE (Trident), Firefox (Gecko), Safari (WebKit) and Chrome (V8), the output of Math.random() can be used to reconstruct the random seed, and thus provide both this seed and the current “JS mileage” (i.e. the number of times Math.random() was invoked).

Re: Xkcd Password Generator

#207

Post by LXicon »

MichaelGagnon wrote: post #176
ScottBurson wrote: post #168

Earlier quoted context omitted.

But there's a long tail of song lyrics. If you pick something obscure, the odds of the attacker even having heard of it become very small (particularly if the attacker is from a different culture than your own). Pick something arty and incomprehensible, and the odds against someone else accidentally stringing those words together in some other context become astronomical. For instance, I'd wager no cracker has ever h…

This gets into the whole "security through obscurity" thing. Ideally, you should use a password-generation system such that if the attacker knows your pasword-generation system (e.g. lines from songs) it would still be infeasible to guess your actual password. Thats why the 4-random-words technique is good. According to XKCD, the 4-random-words technique generates about 17 trillion passwords---all equally likely. But…

there might not be 17 trillion songs, but you aren't limited to the first 4 words of the song. there might be 100-300 words per song and you can pick your starting word anywhere you like.

Re: Xkcd Password Generator

#209

Post by Dove »

a3camero wrote: post #201
Cushman wrote: post #189

Earlier quoted context omitted.

This should be higher up. It's scary to see people — intelligent people, I'm sure — saying things like "And that goes even higher when you add punctuation!" No, it doesn't. All of the reasonable punctuation you could add to a sentence adds only a few bits of entropy at best. It also makes the sentence harder to remember— was there a comma or not? Adding unreasonable punctuation or symbols is even worse— you get sligh…

It's certainly a "very long random string" without context but as people have pointed out above, it's actually not a very good password if people adopted this pattern widely (and you said the attacker knows this). 2000^4 = 16000000000000 possible passwords = 1.6E13 = ([A-Z] + [a-z] + [0-9] + [!@#$%^& ()])^7.1ish. So, your four words from the 2000 word list are equal to a 7ish character password that looks like "Av#12…

Knowledge of the pattern has nothing to do with it. That 2048^4 figure is what I mean when I say such a password is strong, and such a figure presumes the attacker knows what system I am using.

Recall that since the passphrase is randomly generated, that 2048^4 is the true probability of guessing it--all the elements of the set are live possibilities. To compete on equal footing, a seven character password must also be randomly generated.

A password is not necessarily strong simply because it spans a large character set. "Sp1d3r!", for example, may as well be a dictionary word. Raw length "spiderspiderspider" is not necessarily helpful either. Randomness is what you need.

Re: Xkcd Password Generator

#210

Post by wcoenen »

frosas wrote: post #178

How does one calculate password entropy? I deduced this one: entropy = log2(symbols^chars) But using 63 symbols ([a-zA-Z0-9&]) I get 65 bits for Tr0ub4d0r&3, not 28.

You are making the same error that led to the popularity of passwords based on a common word and some substitutions.

Your calculation is for 11 characters, each chosen completely at random out of 63 symbols. People don't chose a password that way - we typically can't generate or remember random symbols.

XKCD's calculation is for a common word + common symbol substitutions and additions: log2(#words) + log2(#capitalization options) + log2(#substitution options) + ...

Post reply on HN