WordPass – Hate passwords, love passphrases
wordpass.io
WordPass – Hate passwords, love passphrases
1–10 of 52 posts
Re: WordPass – Hate passwords, love passphrases
#2Nice touch on displaying the words on hover
Re: WordPass – Hate passwords, love passphrases
#3I would suggest increasing the maximum length from 5. Many applications that don't use iterated hashing schemes like PBKDF2 recommend much longer passphrases for security against brute-force [1].
[1] Off the top of my head: cryptsetup with plain dm-crypt recommends a random English sentence of > 135 characters length (i.e. a passphrase of 27 words at 5 characters per word).
Re: WordPass – Hate passwords, love passphrases
#4While I applaud the nifty tool, we should be trying to get away from single-factor authentication wherever practical. It's also possible that the use of phrases could incur the same mis-use as passwords (common phrases, common words, reusing the same phrase on multiple sites, etc). Passwords just aren't a good idea anymore. (Side note: a lot of password fields i've seen limit you to something like 12 characters; how secure can our phrases be at this length?)
Re: WordPass – Hate passwords, love passphrases
#5I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th?
echo "l($(wc -l /usr/share/dict/american-english|cut -d' ' -f1)^4)/l(2)"|bc -l
67.44701327930010565796
echo "l(75000^4)/l(2)"|bc -l
echo "l(50000^4)/l(2)"|bc -l
So I guess it's still better but it seems like a pretty big oversimplification to assume a length of word (especially a uniform one) and it shouldn't be that much harder to calculate the actual value. Maybe I did something wrong, I don't know.
Re: WordPass – Hate passwords, love passphrases
#6Don't seriously use this tool.
"People shouldn't use passwords that have been generated by a remote service unless they have very very good reasons to trust the tool and the transmission of the data." [0]
Passphrases are generated server-side, and this mines at the heart the security of the system. Are password saved? Yes? No? Who knows?
And you can trust a pair of dice more than an unknown website. Look up diceware on the web and see what I mean.
--
[0] http://discussions.agilebits.com/discussion/10684/password-w...
Re: WordPass – Hate passwords, love passphrases
#7I would suggest increasing the maximum length from 5. Many applications that don't use iterated hashing schemes like PBKDF2 recommend much longer passphrases for security against brute-force [1]. [1] Off the top of my head: cryptsetup with plain dm-crypt recommends a random English sentence of > 135 characters length (i.e. a passphrase of 27 words at 5 characters per word).
It was a larger number at first, but try remembering say 10 words in a row over a long period of time; most people find that difficult.
If hashing is implemented properly (i.e. is slow with a large number of iterations) then passphrases shouldn't have to be that long. And if it isn't, then pretty much anything you use will be as bad as each other (Some people are still using MD5 for example!!) :)
Re: WordPass – Hate passwords, love passphrases
#8While I applaud the nifty tool, we should be trying to get away from single-factor authentication wherever practical. It's also possible that the use of phrases could incur the same mis-use as passwords (common phrases, common words, reusing the same phrase on multiple sites, etc). Passwords just aren't a good idea anymore. (Side note: a lot of password fields i've seen limit you to something like 12 characters; how…
Don't forget that passphrases are also have security uses other than authentication: symmetric encryption of private keys, disk/file encryption, etc. where their use is pretty much unavoidable. Obviously a very long randomly-generated encryption key saved to a usb stick is more resistant to brute force than a memorable passphrase, but you still want to symmetrically encrypt it with a good passphrase to keep it (relatively) secure in case it gets into the wrong hands.
Re: WordPass – Hate passwords, love passphrases
#9While I applaud the nifty tool, we should be trying to get away from single-factor authentication wherever practical. It's also possible that the use of phrases could incur the same mis-use as passwords (common phrases, common words, reusing the same phrase on multiple sites, etc). Passwords just aren't a good idea anymore. (Side note: a lot of password fields i've seen limit you to something like 12 characters; how…
Completely agree. For example, I use two-factor authentication on all accounts that allow me to.
Regarding limiting to 12 characters, the sites in question there are putting there users at risk and it's very likely they aren't storing passwords correctly, leaving anything you put in that password box vulnerable anyway.
Re: WordPass – Hate passwords, love passphrases
#10I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th? echo "l($(wc -l /…
Online bruteforcing is not feasible except for extremely weak passwords or sites with security vulnerabilities. What is feasible is bruteforcing stolen password hashes (think Adobe leak) or say a hard drive encrypted with a memorable password, and this is where secure passphrases come into play.