Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPass – Hate passwords, love passphrases

wordpass.io

Post reply on HN
Print view View original

21–30 of 52 posts

Re: WordPass – Hate passwords, love passphrases

#21

Post by ephemeralgomi »

fennecfoxen wrote: post #17
gioi wrote: post #6

Don't seriously use this tool. "People shouldn't use passwords that have been generated by a remote service unless they have very very good reasons to trust the tool and the transmission of the data." [0] Passphrases are generated server-side, and this mines at the heart the security of the system. Are password saved? Yes? No? Who knows? And you can trust a pair of dice more than an unknown website. Look up diceware…

I also thought that particular XKCD comic was obsolete and debunked at this point. Modern password-crackers aren't ASCII-character-at-a-time and know about dictionary words (and all your 1337sp33k substitutions and trailing numbers).

Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."

Re: WordPass – Hate passwords, love passphrases

#24

Post by ChikkaChiChi »

spinchange wrote: post #20

Don't most password managers have a feature that enables you to locally generate a random, high-entropy password? If you're using a manager in the first place you don't really need to remember it, right? Also, I've always wondered if it was better, worse, or of no consequence to leave spaces in a passpharse.

It can't hurt.

While a space is considered another character, I've come across more than a few instances in which blank characters are scrubbed from user input fields.

So even if you add one, it's entirely possible that it's ignored.

Re: WordPass – Hate passwords, love passphrases

#25

Post by fennecfoxen »

ephemeralgomi wrote: post #21
fennecfoxen wrote: post #17

Earlier quoted context omitted.

I also thought that particular XKCD comic was obsolete and debunked at this point. Modern password-crackers aren't ASCII-character-at-a-time and know about dictionary words (and all your 1337sp33k substitutions and trailing numbers).

Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."

"The oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick." -- Bruce.

https://www.schneier.com/blog/archives/2014/03/choosing_secu...

Re: WordPass – Hate passwords, love passphrases

#26

Post by nikcub »

or shell alias:

    cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"tolower($0)}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " "
suggestion would be to find a better word list than the default aspell since that is the entire Oxford dictionary, which isn't as memorable (although it is an interesting way to learn about new words).

Re: WordPass – Hate passwords, love passphrases

#27

Post by chimeracoder »

I support the conclusion of this XKCD comic, but the math always seemed off to me.

Lets say your dictionary has 100,000 words[0], and your attacker has access to the same list. If the attacker knows that you have chosen four words off of that list, he still only has a 1/4,166,416,671,249,975,000 chance of guessing the right permutation (not combination!). That's less than 2^61, which is certainly very secure.

However, the entropy calculation in the XKCD comic assumes that the characters are uncorrelated with each other, the way they would be if you used a random sequence of characters as your password.

(Of course, this assumes that you choose the words truly (pseudo-)randomly, and not "cherry-picking" permutations that are easy to remember.)

[0] Not unreasonable - /usr/share/dict/words on Ubuntu has over twice as many.

Re: WordPass – Hate passwords, love passphrases

#28

Post by zokier »

fennecfoxen wrote: post #25
ephemeralgomi wrote: post #21

Earlier quoted context omitted.

Link to where the XKCD comic was debunked or shown obsolete? Most of the responses I've seen to it were of the form "well, yeah, but you're not gonna remember a hundred different passphrases, it's much better to use a password manager."

"The oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick." -- Bruce. https://www.schneier.com/blog/archives/2014/03/choosing_secu...

I'm surprised that Schneier would make such a comment. Entropy is entropy, the "difficulty" estimates already except that attackers are fully aware of the method and the dictionary used.

Re: WordPass – Hate passwords, love passphrases

#29

Post by nikcub »

gioi wrote: post #6

Don't seriously use this tool. "People shouldn't use passwords that have been generated by a remote service unless they have very very good reasons to trust the tool and the transmission of the data." [0] Passphrases are generated server-side, and this mines at the heart the security of the system. Are password saved? Yes? No? Who knows? And you can trust a pair of dice more than an unknown website. Look up diceware…

> Passphrases are generated server-side

That was a strange decision to me. There is nothing that can't be done with Javascript on the client, storing the dictionary in the local cache and making the app useful.

If you stripped out the jQuery and everything else and put the randomizing function Javascript right there in the source for everybody to see the page size wouldn't change much either.

Re: WordPass – Hate passwords, love passphrases

#30

Post by ChikkaChiChi »

This is a simple explanation of why passphrasing is better. Please bear with my laymen's mathematics because this isn't my forte:

Let's us XKCD as an example. Your passphrase is correcthorsebatterystaple but since you hate typing out things you abbreviate it to chbs.

In most English passwords, you are limited to the characters visible to you on your keyboard; 52 letters (caps and lowercase), 10 numbers, 32 symbols. That means each piece of your password has 94 possible options. That means there are over 78 million possible combinations to be tried to correctly guess chbs. When you realize that computers can hash through several billion attempts PER SECOND, your password starts to look like a terrible idea.

By typing out correcthorsebatterystaple, you go from 94^4 to 94^25. This is what XKCD points out and it's obvious that this is a big gain.

But it gets better than this...

Let's assume that crackers start to use rainbow tables full of common words used to build phrases like this. Instead of treating passwords by the number of characters, they start hammering on the number of words that are possible.

Instead of increasing the exponent of the perceived slot, you've gone from 94 possible options to however many words there are in the English language. So instead of 94^4, you're dealing with numbers like 250000^4.

This is why security people think passphrasing is better than passwords and why sites like Microsoft that limit you to only 20 character passwords are assholes. It's not the perfect solution, but it will help.

TL;DR: Passphrasing increases the security in your credentials in more ways than you are probably thinking. Do it. DO IT NOW.

Post reply on HN