Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPass – Hate passwords, love passphrases

wordpass.io

Post reply on HN
Print view View original

11–20 of 52 posts

Re: WordPass – Hate passwords, love passphrases

#11

Post by markhemmings »

blueblob wrote: post #5

I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th? echo "l($(wc -l /…

True, account should be disabled after x number of bad guesses. But securing against a "brute force" attack for me is more a case of cracking hashes from a db dump. It's easy to churn though vast numbers of hashes in no time at all these days. Here things like hashing algorithm speed, number of iterations, unique salting and original password length all have a part to play.

Re: WordPass – Hate passwords, love passphrases

#12

Post by equivrel »

markhemmings wrote: post #7
equivrel wrote: post #3

I would suggest increasing the maximum length from 5. Many applications that don't use iterated hashing schemes like PBKDF2 recommend much longer passphrases for security against brute-force [1]. [1] Off the top of my head: cryptsetup with plain dm-crypt recommends a random English sentence of > 135 characters length (i.e. a passphrase of 27 words at 5 characters per word).

It was a larger number at first, but try remembering say 10 words in a row over a long period of time; most people find that difficult. If hashing is implemented properly (i.e. is slow with a large number of iterations) then passphrases shouldn't have to be that long. And if it isn't, then pretty much anything you use will be as bad as each other (Some people are still using MD5 for example!!) :)

I don't see the harm in leaving the option in, given that for some applications a longer passphrase is critical (not everything can use iterated hash schemes: for instance if you want to deniably encrypt a hard drive partition to look like random data).

EDIT: also, 'explicit' is a nice touch, makes some pretty memorable passphrases, but I hope you're not taking from a small list of profanities, since that would seriously diminish the entropy. Be sure to factor in the (probably) much smaller number of possible 'explicit' passphrases when doing entropy calculations.

Re: WordPass – Hate passwords, love passphrases

#13

Post by markhemmings »

gioi wrote: post #6

Don't seriously use this tool. "People shouldn't use passwords that have been generated by a remote service unless they have very very good reasons to trust the tool and the transmission of the data." [0] Passphrases are generated server-side, and this mines at the heart the security of the system. Are password saved? Yes? No? Who knows? And you can trust a pair of dice more than an unknown website. Look up diceware…

I agree with and applaud the use of seriously here ;)

Re: WordPass – Hate passwords, love passphrases

#14

Post by maxerickson »

blueblob wrote: post #5

I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th? echo "l($(wc -l /…

The comic uses 11 bits per 'common word' to get to 44 (there are 11 little boxes by each word in the comic).

Underestimating that value isn't a bad thing.

Re: WordPass – Hate passwords, love passphrases

#15

Post by williamcotton »

equivrel wrote: post #10
blueblob wrote: post #5

I have always had a problem with this xkcd because most sites would disable your password after a number of bad guesses (making it not really matter that much), and additionally I don't see where 2^44 comes from. Taking the average word length selected and then computing the entropy using the average word length 4 times? Why not use the number of potential dictionary words and raise that to the 4th? echo "l($(wc -l /…

Online bruteforcing is not feasible except for extremely weak passwords or sites with security vulnerabilities. What is feasible is bruteforcing stolen password hashes (think Adobe leak) or say a hard drive encrypted with a memorable password, and this is where secure passphrases come into play.

Or better yet, deterministic public keys like is seen with bitcoin.

Re: WordPass – Hate passwords, love passphrases

#17

Post by fennecfoxen »

gioi wrote: post #6

Don't seriously use this tool. "People shouldn't use passwords that have been generated by a remote service unless they have very very good reasons to trust the tool and the transmission of the data." [0] Passphrases are generated server-side, and this mines at the heart the security of the system. Are password saved? Yes? No? Who knows? And you can trust a pair of dice more than an unknown website. Look up diceware…

I also thought that particular XKCD comic was obsolete and debunked at this point. Modern password-crackers aren't ASCII-character-at-a-time and know about dictionary words (and all your 1337sp33k substitutions and trailing numbers).

Re: WordPass – Hate passwords, love passphrases

#18

Post by ivanhoe »

Actually this is not such a good idea, this type of passwords is very easy to break with modern dictionary attacks. Just get yourself a password manager and generate really random passwords. If you really have to remember the password then at least try to mix the words with numbers and non-alphanumeric chars.

Re: WordPass – Hate passwords, love passphrases

#19

Post by gioi »

ivanhoe wrote: post #18

Actually this is not such a good idea, this type of passwords is very easy to break with modern dictionary attacks. Just get yourself a password manager and generate really random passwords. If you really have to remember the password then at least try to mix the words with numbers and non-alphanumeric chars.

Reynold (Diceware creator) says:

"Five words are breakable with a thousand or so PCs equipped with high-end graphics processors (criminal gangs with botnets of infected PCs can marshal such resources). Six words may be breakable by an organization with a very large budget, such as a large country's security agency. Seven words and longer are unbreakable with any known technology, but may be within the range of large organizations by around 2030. Eight words should be completely secure through 2050."

http://world.std.com/~reinhold/dicewarefaq.html#howlong

Re: WordPass – Hate passwords, love passphrases

#20

Post by spinchange »

Don't most password managers have a feature that enables you to locally generate a random, high-entropy password? If you're using a manager in the first place you don't really need to remember it, right?

Also, I've always wondered if it was better, worse, or of no consequence to leave spaces in a passpharse.

Post reply on HN