Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

271–280 of 299 posts

Re: Xkcd Password Generator

#271

Post by ZoFreX »

darklajid wrote: post #38
ZoFreX wrote: post #18

I would actually advise going against this advice. While it isn't a best practice, password sharing can and does happen, as does shoulder-surfing. It would take a LOT of effort to memorise my password, but a simple four word password will probably be remembered by accident. In a year's time if I piss a friend off, I don't want my Facebook password to be readily accessible in their memory. I think more people need to…

How do you share your preferred password? Because I guess everything but sending it per text/mail would be tedious, while it would work better with a couple of words. Shoulder surfing: It's certainly a risk, but I'd say that prolonged shoulder surfing shouldn't be possible. If I type fast, it will be very hard to make out the phrase. If I type slow, you cannot stand around that long. And - I'm not a security expert,…

> And - I'm not a security expert, but how much do you gain if you saw a couple of chars here? My intuition (yeah, shouldn't trust that) says that it's worse if I watch you and know the _first_ character of your password than you seeing the first 1-3 characters of the first word of my passphrase?

Novel thought and possibly worth persuing, I hadn't thought of that. I want to re-iterate this isn't something I broadly apply across all my passwords or even many of them, just that for some users password sharing is a use-case.

Re: Xkcd Password Generator

#272

Post by bryanlarsen »

glenra wrote: post #197
bryanlarsen wrote: post #150

Earlier quoted context omitted.

The requirement for many of my website is simply that it "must not consist solely of lowercase letters". (as well as a minimum length).

>must not consist solely of lowercase letters Which is exactly the sort of terrible restriction xkcd is criticizing.

A space is not a lowercase letter, so the xkcd password would pass my test.

Re: Xkcd Password Generator

#273

Post by billybob »

burgerbrain wrote: post #158
kragen wrote: post #141

Earlier quoted context omitted.

Not necessarily. If only one-fourth of all English words are grammatical after an average prefix, then you lose two bits of entropy off each word after the first. I suspect that the actual situation is not as bad as that. You might end up using "uncommon" words like "deceased", "advent", "fearful", and "ram" to compensate, instead of more common words like "strongly", "contains", "afterwards", and "corporate", but th…

Any narrowing of the search space will most definetely reduce entropy.. by how much is calculatable but I don't have the time nor language statistics right now to do it.

I'm not sure the technical meaning of entropy in this context, but personally, I would offset the narrowing effect of "restrict to grammatical phrases" by adding uncommon words. "Besotted ophthalmoscopes gambol indicatively" forms a coherent, if silly, word picture for me, so I think I can remember it.

As far as possible combinations, my vague memories of linguistics 1001 include the idea that this is one of the essential properties of language: it has so many possible combinations, that every speaker is continually creating sentences that have never before been uttered. Unlike, say, honey bee dances, which are often repeated.

Re: Xkcd Password Generator

#274

Post by demallien »

xkcdentropy wrote: post #268
demallien wrote: post #52

Earlier quoted context omitted.

If the dictionary really has 100 000 words, you're looking down the barrel of 52 bits of entropy for a three word phrase In a more likely dictionary of the 5000 most commonly used words in the English language, you still get a three word pass phrase of about 40bits of entropy. Make that a four word passphrase, and you're back up around 52 bits.

This is simply incorrect. If you assume you really do have 100 000 "characters" in your alphabet this is correct. However, your alphabet follows a certain pattern: It's English text. At that point its easier to brute force the individual characters. English text has about 1 to 2 bits of entropy per character. Lets assume 1.5 bits per character on average. That means that to really get 52 bits of entropy for a 3 word…

Yeah, no. If I have a dictionary of 100000 words, then each word represents about 17 bits of entropy. If I have three words, that makes 3 x 17 = 51 bits of entropy.

Re: Xkcd Password Generator

#275

Post by pedro_a »

bryanlarsen wrote: post #272
glenra wrote: post #197

Earlier quoted context omitted.

>must not consist solely of lowercase letters Which is exactly the sort of terrible restriction xkcd is criticizing.

A space is not a lowercase letter, so the xkcd password would pass my test.

Then the space would be "the obeisance to the stupid website piece". Note that the entropy of "correct horse battery staple" is only one bit more than "correcthorsebatterystaple".

Re: Xkcd Password Generator

#276

Post by nakkiel »

DufusM wrote: post #162
nakkiel wrote: post #20

This might come in handy: shuf -n4 /usr/share/dict/words | tr '\n' ' '

I don't think those words are very practical. For example, 4 consecutive runs produced: shippon preannouncer half-hourly withgang egotize baffs chapter monolater photoengraver beachhead linguidental autoheader hazeled defloration exhumate barretries none of which seem particularly easy to remember (or spell even).

It's like with any other program supposed to help you picking up a password; you run it a couple of times until you find something that ticks.

  Beirut ejecting sidings mourns

Re: Xkcd Password Generator

#277

Post by pedro_a »

onemoreact wrote: post #137
Lexarius wrote: post #62

Earlier quoted context omitted.

This is why, for my lab's password changer, the requirement for short passwords is simply that it must have one upper, one lower, one digit, and one none-of-the-above (and be at least 8 characters). If you have a long password (at least 16 characters), all other requirements are waived so that you can use passphrases.

Forcing one or more digits has little value. You are better off with 1 uppercase one lower case and 2 non alphabet characters. (Users are very likely to be replacing a letter with 1,0 so 2options * 8posistions = 16 possibility's = fail.)

Which is exactly the sort of terrible rules xkcd is criticizing (paraphrasing glenra).

Instead of 4 extra enforcements you could add 8 extra characters.

Your entropy is (somewhat simplified)

One 8 letter word: 15 bits

1 uppercase = 3 bits (or even just 1 bit, people capitalize the first letter)

reversing 2 rules above: 1 bit

replacing two characters at random places: 8*7/2 = 4.8 bits

inserting 2 random non alphabet characters: 40^2 = 10.6 bits Total: 34.4

The entropy of three medium difficulty words is log(4000^3) = 35.9

Instead of memorizing K!ybo4rd it could be mykeyboardisblue.

Re: Xkcd Password Generator

#278

Post by nakkiel »

jcr wrote: post #212
Dove wrote: post #160

I find the discussion surrounding the XKCD strip alarming for the superstition it reveals about password generation. The particular theme I am alarmed by is that people seem to think that if a password looks alien, or was difficult for them to come up with, it will be hard for a machine to guess. Look, we're working with big numbers here. You need to do the math. In this thread alone, I've seen suggestions to use a c…

I resent your accusation that I use gibberish for my passwords; I actually use perfectly well formed executable code in perl.

Had you used brainfuck, I would have downvoted you.

Re: Xkcd Password Generator

#279

Post by pedro_a »

burgerbrain wrote: post #158
kragen wrote: post #141

Earlier quoted context omitted.

Not necessarily. If only one-fourth of all English words are grammatical after an average prefix, then you lose two bits of entropy off each word after the first. I suspect that the actual situation is not as bad as that. You might end up using "uncommon" words like "deceased", "advent", "fearful", and "ram" to compensate, instead of more common words like "strongly", "contains", "afterwards", and "corporate", but th…

Any narrowing of the search space will most definetely reduce entropy.. by how much is calculatable but I don't have the time nor language statistics right now to do it.

You can modify slightly your sentence without loosing entropy

"married greatly snake battle" becomes "a married great snake will battle".

"correct horse battery staple" becomes "correctly the horse inserted the battery staple"

Note that the extra words add little or no entropy, at the cost of increased length.

Re: Xkcd Password Generator

#280

Post by [deleted] »

eru wrote: post #190
scythe wrote: post #119

Earlier quoted context omitted.

>Yes, though the number of additional bits you get from increasing the size of the dictionary decreases fast. Well, sure -- but once you're at around two or three languages, you get to imagine that the attacker doesn't know what languages you're using. If I use English, Japanese, and Spanish, I can figure on the attacker needing to check the Germanic (English, Dutch, German), Romance (Spanish, French, Italian), and A…

Always assume the attacker knows your scheme, but not your random bits.

[deleted]
Post reply on HN