Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A plastic card for easy to remember strong passwords

qwertycards.com

Post reply on HN
Print view View original

41–50 of 110 posts

Re: A plastic card for easy to remember strong passwords

#41

Post by eric_bullington »

__david__ wrote: post #29
sarciszewski wrote: post #20

Earlier quoted context omitted.

https://github.com/resonantcore/lib/blob/master/js/diceware/... https://github.com/resonantcore/lib/blob/master/demo/dicewar... Run this locally, e.g. dw = new Diceware(); dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() { console.log("Diceware loaded!"); }); console.log(dw.getWords(8).join(' '));

If you're on linux you can usually just do: shuf -n 5 /usr/share/dict/words On Mac OS X you need coreutils for shuf, which you can get from brew (it's called gshuf once installed).

I would be very cautious about using shuf for password generation, since it doesn't use a cryptographically-secure random number generator (I just checked the source).

Edit: I see that shuf permits the use of custom seeds, so you can do the following, and it will be secure:

    shuf -n 5 --random-source=/dev/urandom /usr/share/dict/words

Re: A plastic card for easy to remember strong passwords

#42

Post by cplease »

gravedave wrote: post #21
samspot wrote: post #18

Except it's not going to work, because of the bank who doesn't allow '(' as a special character, or the ticket website that requires at least 3 digits, or the financial firm who only allows 8 character passwords. As soon as you have a few sites with 'rogue' password policies, the system breaks down.

There are ways around it: using the code for the key directly north-west of the problematic character, and if that's a bad character go further, maybe wrap around, or try to follow through the problem character (a/& -> &/| -> |/f, thus f would be the code for a) etc. As for remembering which sites have what restrictions, I can keep that stuff in my head (looking at you Microsoft), but I guess you may have more accoun…

> Then again, when a password fails, then all you'd have to do is retry with a safer version

And after three or five failed login attempts you get locked out and have to call the bank for a password reset, and throw away the damn card in frustration.

> (and maybe only have two password kinds, for convenience - full-blown char support, and minimalistic lowercase-letters only, so you'd only have to retry a single time after the first failed login).

If you're authenticating with more than HN and Reddit, you'll encounter much more than two mutually exclusive password policies.

Re: A plastic card for easy to remember strong passwords

#43

Post by _paulc »

__david__ wrote: post #29
sarciszewski wrote: post #20

Earlier quoted context omitted.

https://github.com/resonantcore/lib/blob/master/js/diceware/... https://github.com/resonantcore/lib/blob/master/demo/dicewar... Run this locally, e.g. dw = new Diceware(); dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() { console.log("Diceware loaded!"); }); console.log(dw.getWords(8).join(' '));

If you're on linux you can usually just do: shuf -n 5 /usr/share/dict/words On Mac OS X you need coreutils for shuf, which you can get from brew (it's called gshuf once installed).

Or:

  python -c 'import random;w=open("/usr/share/dict/words").readlines();print " ".join([random.choice(w).strip() for _ in range(5)])'

Re: A plastic card for easy to remember strong passwords

#44

Post by jrockway »

bro-kaizen wrote: post #40
stevewilhelm wrote: post #15

What prevents me from using this type of strategy is the inconsistent adoption of password requirements. For example, some of the websites I use require passwords to contain at least one capital letter, or a digit, or a punctuation mark (e.g. ! ? #, etc.). But other Website do not allow punctuation marks or digits. Some require a password of a minimum length, but a dwindling few can only accept fairly short maximum l…

Wait really? It feels like almost every time I make a new account somewhere and drop in the 200 character high-entropy password that LastPass generated, I get a silent failure or misleading error message about "your username was not recognized." Then I try guessing which feature of my candidate password is pissing off the site: Is it the whitespaces? Special characters? Length? This is particularly maddening because…

You use 200 character passwords? I'm happy with 12.

Re: A plastic card for easy to remember strong passwords

#45

Post by techrat »

jameshart wrote: post #13
agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

It's vulnerable to a known ciphertext attack, yes. But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker. An attacker looking to bruteforce a compromised file of passwords is going to struggle to figure out that your password is sh(/J3HqAfQsu..u.rqf. Even if they do find it, what would tip them off that it was gen…

>But the assumption of password usage is that the password itself is never stored - the ciphertext of this cipher should itself not be available to an attacker.

I think the Gawker leak alone is enough of a precedent to ensure that this can never be assumed.

Re: A plastic card for easy to remember strong passwords

#47

Post by RadioactiveMan »

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

What is the point of decoding this back into the user's original "ENIGMA" and "AMAZON" strings? In this case, "sh(/J3HqAfQsu..u.rqf" is the user's password. If you have that, there is nothing to crack.

Edit: I see "Combine with another compromised password, and we're coming dangerously close to being able to generate a password for any arbitrary website.", which means that if an attacker could obtain a couple of these passwords, they could determine (a lot of) your qwertycard and gain access to more of your accounts.

However, by the time an attacker has any of your passwords, I'm not sure that reverse engineering your qwertycard is an issue. As others put better than I, this would also mean that in addition to obtaining one or more plaintext passwords, the attacker would have to be targeting you specifically and know how you generated the passwords.

Re: A plastic card for easy to remember strong passwords

#48

Post by [deleted] »

agwa wrote: post #7

This is a substitution cipher and it's not very secure. Consider what we can do if we compromise the Amazon password that's given as an example on the website: sh(/J3HqAfQsu..u.rqf Since the password came from Amazon, we know that the last 6 characters are "Amazon," which tells us that: . = A u = M r = Z q = O f = N Now we can start attacking the codeword, which are the characters between the 8-character "space bar c…

[deleted]

Re: A plastic card for easy to remember strong passwords

#49

Post by subleq »

chronial wrote: post #12
mason240 wrote: post #5

This would actually be very useful for my Google and LastPass password. I have everything else in my LastPass manager, but it is always trying to get into my google account from different places is difficult, so I have a rememberable password for both. This would let me keep a much more secure password for both.

Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.

You can use https://www.fusionbox.com/mouseware/ to do this
Post reply on HN