Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Correct Horse Battery Staple: Secure Password Generator

correcthorsebatterystaple.net

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Correct Horse Battery Staple: Secure Password Generator

#11

Post by thfuran »

bartvk wrote: post #9

There are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/

Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.

Re: Correct Horse Battery Staple: Secure Password Generator

#12

Post by JohnFen »

strulovich wrote: post #6
jkingsman wrote: post #2

It's a cute idea and I love the concept from XKCD, but the best practice is just to use a password manager and stop trying to remember passwords (and absolutely never reusing passwords).

But: - you need a password for your password manager - you also need a password for your actual desktop/phone, when the manager is inaccessible. - you may have a work computer requiring a different password as well Here are already 3, ideally different, passwords you need to remember.

I only have to remember one password: to my password manager. My phone uses a different unlock method entirely, and my work computer's password is stored in my password manager.

Although after a couple of days of using a new password regularly, I can't help but have it memorized anyhow.

Re: Correct Horse Battery Staple: Secure Password Generator

#15

Post by JohnFen »

Maxburn wrote: post #10
jkingsman wrote: post #2

It's a cute idea and I love the concept from XKCD, but the best practice is just to use a password manager and stop trying to remember passwords (and absolutely never reusing passwords).

Most humans create terrible passwords (myself included) and I really benefit from simply having a random word generator. I use generators like these to create a random word cloud to pick and chose from to create my actual password. I also might have to read particular passwords over the phone to someone in a rare emergency so real words help with that a lot. This particular one doesn't throw enough random symbols in…

Yes, I use a random password generator for all of my passwords. But I don't use the XKCD method because I actually find that style of password more difficult to remember and more of a pain to type in.

Re: Correct Horse Battery Staple: Secure Password Generator

#16

Post by etrautmann »

rootusrootus wrote: post #13

At this point, average users are better off with a password manager and/or passkeys. The fraction of users willing to learn more than one decent password and not use it in multiple places is probably 1% or less.

Yes, but this is a great way to create a master password for your manager

Re: Correct Horse Battery Staple: Secure Password Generator

#17

Post by rcoveson »

personjerry wrote: post #7

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

It's a password generator hosted on a domain with zero reputation. Insufficient entopy is nowhere near as concerning as the software distribution mechanism.

Audit the code? Maybe it's different tomorrow. Maybe it's different based on client fingerprint! Internet explorer users in retirement communities get the version with a known, fixed random number seed.

Re: Correct Horse Battery Staple: Secure Password Generator

#18

Post by Symbiote »

personjerry wrote: post #7

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

  )=*vZqV

  Grateful-Afternoon-Resistance-South-0
The second is much easier to remember, and common security measures need to be practical.

Incidentally, I have two small shell functions to generate these. Tweaked slightly:

Re: Correct Horse Battery Staple: Secure Password Generator

#19

Post by throw0101c »

personjerry wrote: post #7

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

Diceware recommended going to six words back in 2014:

* https://arstechnica.com/information-technology/2014/03/dicew...

They have 7,776 words in their list; that gives 77.5 bits.

* https://en.wikipedia.org/wiki/Diceware

Re: Correct Horse Battery Staple: Secure Password Generator

#20

Post by sparcpile »

This is nice. I previously wrote up a KornShell script that did that with the 3000 most common English words, added the dashes, and two digit numbers to make up a suitable password for my password manager and places where I could not use a password manager.

I also used dashes as a word separator and to count as a special character. Nearly everyone allows for - , but it is hit or miss for other special characters.

Post reply on HN