41–50 of 61 posts
But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14
Earlier quoted context omitted.
Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…
I feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.
https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
Earlier quoted context omitted.
Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…
I feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.
But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14
I had a idea similar to this, where you would misspell one or two words randomly - and then generate a sentence below the password to help with remembering the built-in obfuscation. Such as the Generate Password would be listed as: > Correct Horce Battery Staple > "Correct Horse-with-a-C Battery Staple"
Earlier quoted context omitted.
I had a idea similar to this, where you would misspell one or two words randomly - and then generate a sentence below the password to help with remembering the built-in obfuscation. Such as the Generate Password would be listed as: > Correct Horce Battery Staple > "Correct Horse-with-a-C Battery Staple"
Why not just use "Correct Horse-with-a-C Battery Staple" as your password then?
"Horse-with-a-C" is a longer password, but could possibly be hit using an algorithm that expects "with-a-[letter]" to be generated as part of a password.
The randomized misspelling of a word-or-two was intended to break a dictionary attack.
Earlier quoted context omitted.
I had a idea similar to this, where you would misspell one or two words randomly - and then generate a sentence below the password to help with remembering the built-in obfuscation. Such as the Generate Password would be listed as: > Correct Horce Battery Staple > "Correct Horse-with-a-C Battery Staple"
What’s the point? Obfuscation doesn’t increase entropy.
Earlier quoted context omitted.
I feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.
EEF’s is better. https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
There are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/
There's no way people actually use random websites to generate their passwords, right? Like, I can't just post or comment a password generator to a reasonably-tech-savvy forum like HN and have people actually use it to generate their next email password, can I? Surely there's at least some communal wisdom about how to correctly obtain software that you can reasonably trust with such an important task?
At a glance, the base dictionary is 2280 words; jargon is 8800; science is 575. So, definitely consider adding all the lists! That gives (check my math) ~13.5 bits entropy per word.
[1] https://bitbucket.org/jvdl/correcthorsebatterystaple/src/mas...
Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful
Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…