Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

221–230 of 299 posts

Re: Xkcd Password Generator

#221

Post by alanh »

ScottBurson wrote: post #168
gjm11 wrote: post #154

Earlier quoted context omitted.

Be aware that adding to the length simply by taking more of the lyrics adds very little entropy. If you're trying "Oh say can you see" then it doesn't take a lot of extra bits also to try "Oh say can you see by the dawn's early light what so proudly we hailed at the twilight's last gleaming". Similarly, extended passages of text -- even if they don't come from a restricted corpus like that of song lyrics -- have less…

But there's a long tail of song lyrics. If you pick something obscure, the odds of the attacker even having heard of it become very small (particularly if the attacker is from a different culture than your own). Pick something arty and incomprehensible, and the odds against someone else accidentally stringing those words together in some other context become astronomical. For instance, I'd wager no cracker has ever h…

What happens when your obscure song makes the soundtrack for a hit movie next summer?

Re: Xkcd Password Generator

#222

Post by alanh »

kragen wrote: post #138
dpark wrote: post #61

Earlier quoted context omitted.

These are the real issues with this. Banks seem to be borderline idiots when it comes to password security: case-insensitive, no spaces, 20-character max, small choice of "special characters". These are from Amex, who's password requirements sadly were even worse a few months ago. With crappy password requirements, it's impossible to use decent passphrases. Getting locked out of your account for 3 failed attempts at…

It turns out that you are mistaken. Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-... That gives you 27 bits of entropy. The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences. That gives y…

Edit: Oops, as dpark points out, I swapped two digits. My apologies. Below, my original, erroneous comment.

41 bits of entropy means you have on the order of a one in 10^12 chance (2^41) of guessing it, and 2,000^4 is on the order of 10^16. So how is the former "one eighth as secure" as the other? Wouldn’t it be 10^4 times less secure, that is, 10,000 times more likely to be cracked?

Re: Xkcd Password Generator

#223

Post by dpark »

alanh wrote: post #222
kragen wrote: post #138

Earlier quoted context omitted.

It turns out that you are mistaken. Your favorite book is almost certainly chosen from the 129 million books that Google knows about: http://www.fastcompany.com/1678254/how-many-books-are-there-... That gives you 27 bits of entropy. The average book length is probably not over 400 pages. An average page probably doesn't have over 25 sentences on it. So the whole book contains only ten thousand sentences. That gives y…

Edit: Oops, as dpark points out, I swapped two digits. My apologies. Below, my original, erroneous comment. 41 bits of entropy means you have on the order of a one in 10^12 chance (2^41) of guessing it, and 2,000^4 is on the order of 10^16. So how is the former "one eighth as secure" as the other? Wouldn’t it be 10^4 times less secure, that is, 10,000 times more likely to be cracked?

2000^4 is on the order of 10^13. Specifically it's 1.6E13. Maybe you accidentally swapped the 1.6 and the 13?

Re: Xkcd Password Generator

#225

Post by dpark »

klipt wrote: post #213
dpark wrote: post #89

Earlier quoted context omitted.

> H4ck3r N3ws H4ck3r News H4cker News Hacker News This is a terrible idea. It's one thing to ask a person to remember which characters they replaced in a word. It's another thing entirely to ask them to remember three different ways they swapped characters. This is a recipe for having to brute-force your own password. It's also still not as secure as you might imagine. There's very little entropy added by swapping ch…

> You've got a ton of entropy there. Nope - http://news.ycombinator.com/item?id=2873474

Sorry, should have linked back to that myself. Still, 41 bits, while less than the 44 bits from the XKCD algorithm, is a lot more entropy than most passwords have.

Re: Xkcd Password Generator

#226

Post by ryanelkins »

I just hate sites that won't accept spaces and restrict how long a password can be (usually to something relatively short like 8 or 12 characters). Also, many require you to use mixed case and/or numbers or "special" characters. I usually just use complete sentences.

Re: Xkcd Password Generator

#228

Post by tucosan »

as embarrassing as it may seem, although having read the good part of this thread, i still don't understand why a four word password, can be more random than something i would get like this:

    ~$ pwgen -s 8 C0olz5KM
Would anybody care to explain this to me, or at least point me to a good place where i can read up on this?

Re: Xkcd Password Generator

#229

Post by jcitme »

Dove wrote: post #218
Ideka wrote: post #215

Earlier quoted context omitted.

May I ask how did you find out about that study? It sounds very interesting. I've got to try it sometime :).

You mean the statistics demonstration? I'm sure I've seen it in several places. I know of two tricks for detecting the students. The first is to look for six or seven heads or tails in a row. Over a hundred tosses, a coin will probably do that, but humans "being random" won't. The other is to look at the page as a sequence of "HHH" and "TT" strings and estimate how many there are. A coin, of course, changes from head…

Answers please?

Re: Xkcd Password Generator

#230

Post by moe »

Cushman wrote: post #216
LXicon wrote: post #207

Earlier quoted context omitted.

there might not be 17 trillion songs, but you aren't limited to the first 4 words of the song. there might be 100-300 words per song and you can pick your starting word anywhere you like.

But it falls into the same boat as any dictionary attack. Most people with a passphrase are probably going to use one from a song. 90% of them are going to use one of the top 1,000 songs, 90% of them are going to start at the beginning of a line. If we say there are ~20 unique lines in the average song, and most people won't use more than ten successive words even if it bridges a line, that's 1000 * 20 * 10 = a keysp…

There's an easy way to defeat this:

   smellz like T33N SPIRIT!
Trivial to memorize. Unlikely to brute force.

I use phrases like that for the few locations where password managers don't reach (i.e. the password manager master password).

Post reply on HN