Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google knows nearly every Wi-Fi password in the world

blogs.computerworld.com

Post reply on HN
Print view View original

291–300 of 312 posts

Re: Google knows nearly every Wi-Fi password in the world

#291

Post by keenerd »

srollyson wrote: post #250
Fixnum wrote: post #162

Earlier quoted context omitted.

The point is you're supposed to use truly random word combinations since those are at least memorable. $ wc -l /usr/share/dict/words 119095 $ python -c 'print(119095 ** 4)' 201175048646341950625 $ python -c 'print(85 ** 10)' 19687440434072265625 So, even if your target is known to be using this scheme in pure form, this has more entropy than a completely random 10-digit password (assuming ~85 characters) -- and who w…

Can never turn down an opportunity for a one-liner. $ perl -E 'open(my $fh, " ; close $fh; say join " ", map {$words[int rand @words]} 1..4' menu chemists administrative seeps Might have to run it a couple of times before you get something that you can memorize.

Ew.

    shuf -n 4 /usr/share/dict/words | tr -dc 'A-Za-z0-9'

Re: Google knows nearly every Wi-Fi password in the world

#292

Post by grandalf »

tptacek wrote: post #283
grandalf wrote: post #274

Earlier quoted context omitted.

I am very cynical about Google these days after the revelations about its cooperation with the NSA. Thanks for your work and I hope you don't take my remarks as any kind of criticism of the work you do. Put more cautiously, I think indirect corporate benefit is the main impetus for Google's philanthropy and lobbying programs. There is not necessarily a specific business outcome associated with the philanthropy... it'…

It is likely you have even less of an idea of what you're talking about when it comes to Google's interactions with NSA than you do about how their motivations w/r/t SOPA.

Please enlighten me.

Re: Google knows nearly every Wi-Fi password in the world

#293

Post by losvedir »

vezzy-fnord wrote: post #137
prawks wrote: post #110

Earlier quoted context omitted.

> passwords are either easy for computers to crack or hard for humans to remember Obligatory xkcd comic: https://xkcd.com/936/

I loathe whenever people post that comic for one simple reason. Although mathematically the password given in the comic has a higher entropy and would take more time to crack under normal circumstances, the problem is that it follows a very simple and easily describable pattern: smash (four) dictionary words together into a combination. Crackers will simply start using wordlist rules to generate large lists of meshed…

I think you've missed the point.

There are more possible permutations of four words than permutations of 10 upper/lowercase letters, digits, and common symbols. The four random word approach is harder to crack.

Re: Google knows nearly every Wi-Fi password in the world

#294

Post by tptacek »

grandalf wrote: post #292
tptacek wrote: post #283

Earlier quoted context omitted.

It is likely you have even less of an idea of what you're talking about when it comes to Google's interactions with NSA than you do about how their motivations w/r/t SOPA.

Please enlighten me.

I have, at length, in the past, and it's very disingenuous of you to pretend that you don't know that. Most people who accuse Google of being a tool of NSA have the excuse that they got the idea from the Guardian, which later retract^H^H^H^H^H^H^Hcontradicted itself out of the accusation. But you know that already. You accuse Google of being a tool of NSA because you want them to be, because you believe that by repeating a lie over and over again you can somehow crowbar reality into your weird little conspiracy theory, or at least get a bunch of people on HN on board with it.

Re: Google knows nearly every Wi-Fi password in the world

#295

Post by idProQuo »

srollyson wrote: post #250
Fixnum wrote: post #162

Earlier quoted context omitted.

The point is you're supposed to use truly random word combinations since those are at least memorable. $ wc -l /usr/share/dict/words 119095 $ python -c 'print(119095 ** 4)' 201175048646341950625 $ python -c 'print(85 ** 10)' 19687440434072265625 So, even if your target is known to be using this scheme in pure form, this has more entropy than a completely random 10-digit password (assuming ~85 characters) -- and who w…

Can never turn down an opportunity for a one-liner. $ perl -E 'open(my $fh, " ; close $fh; say join " ", map {$words[int rand @words]} 1..4' menu chemists administrative seeps Might have to run it a couple of times before you get something that you can memorize.

You can use a dictionary of the most common 10000 words, you'd still have loads of entropy.

Re: Google knows nearly every Wi-Fi password in the world

#296

Post by kazagistar »

dominotw wrote: post #188
LaGrange wrote: post #151

Earlier quoted context omitted.

While I don't like at all the idea of government surveillance without court order, I find the idea of corporate surveillance even more horrifying. Actually, this is what amuses me in the whole privacy affair. So a bunch of companies were using and abusing your data to target ads at you and shape your news stream so that it's more addictive, and people were cheering. A government (still mostly democratic, though not f…

I dont really see your logic, Gubment can put you in prison, take your rights away, companies targeting ads can't. It makes sense that one would be outraged at the former.

Compainies can do the same harm as government. Individuals can do the same harm as government. But a restriction applies to them all... they get in trouble with society if they do.

Re: Google knows nearly every Wi-Fi password in the world

#297

Post by x0054 »

throwaway2048 wrote: post #223
tjohns wrote: post #170

Earlier quoted context omitted.

Do you have a citation for that claim about WPS and home users? While it certainly could be the crowd I hang out with (not all of which are techies, mind you), but I've never met anyone who uses WPS.

WPS is enabled by default on practically every wifi router sold in the last 7ish years.

My buddy, who does security research, tells me that on stock firmwares of a lot of routers WPS is turned on and can not be turned off. He claimed that he encountered several routers where after turning off WPS in the settings he was still able to use WPS vulnerability to crack the key. He thinks it has to do with the setting not being fully applied, as in, the check mark changes, but nothing happens on the backend.

Mind you, I think with open source firmware like TomatoUSB and good password you should be good.

Re: Google knows nearly every Wi-Fi password in the world

#298

Post by grandalf »

tptacek wrote: post #294
grandalf wrote: post #292

Earlier quoted context omitted.

Please enlighten me.

I have, at length, in the past, and it's very disingenuous of you to pretend that you don't know that. Most people who accuse Google of being a tool of NSA have the excuse that they got the idea from the Guardian, which later retract^H^H^H^H^H^H^Hcontradicted itself out of the accusation. But you know that already. You accuse Google of being a tool of NSA because you want them to be, because you believe that by repea…

You are partially right. All of my beliefs are provisional and I'm waiting to be proven wrong. I'd very much prefer to believe that Google acted properly (not necessarily legally) with respect to its cooperation with NSA. To date I am still not convinced.

How is it possible to feel comfortable with Google's answers when you consider that companies are forbidden from disclosing some information? I'm equally skeptical of the truthfulness of both Google's and the NSA's responses to the revelations.

I'm not able to accept the whole "trust us, everything was circuitously legal so there's nothing to worry about" excuse.

Re: Google knows nearly every Wi-Fi password in the world

#299

Post by x0054 »

a-priori wrote: post #98
devx wrote: post #87

Earlier quoted context omitted.

Isn't it about time we get new security standards for Wi-Fi? Is there anything in the works right now to replace WPA2?

The problem isn't limited to WPA2. As far as I know, in and of itself it's actually fairly secure. Most of the problem is that passwords are either easy for computers to crack or hard for humans to remember. The middle ground has disappeared as computational power has increased.

The best human rememberable password is 4-5 words from a dictionary + a special character. Assuming that most people have roughly 20k words vocabulary and that most keyboards can type easily say 60 characters, you get 20,000^460 or 9.610^18 passwords. This means that if you were to crack at a rate of one billion (with a b) passwords per second (unrealistic) you would still take on average of 9,000 years or 18,000 years maximum.

Re: Google knows nearly every Wi-Fi password in the world

#300

Post by Figs »

x0054 wrote: post #299
a-priori wrote: post #98

Earlier quoted context omitted.

The problem isn't limited to WPA2. As far as I know, in and of itself it's actually fairly secure. Most of the problem is that passwords are either easy for computers to crack or hard for humans to remember. The middle ground has disappeared as computational power has increased.

The best human rememberable password is 4-5 words from a dictionary + a special character. Assuming that most people have roughly 20k words vocabulary and that most keyboards can type easily say 60 characters, you get 20,000^4 60 or 9.6 10^18 passwords. This means that if you were to crack at a rate of one billion (with a b) passwords per second (unrealistic) you would still take on average of 9,000 years or 18,000 y…

If a person is choosing the words, they aren't going to be uniformly chosen from the list. For example, I'd be willing to bet "monkey" is much more common in passwords than "contacted" even though both words are probably known by about the same number of people.
Post reply on HN