Passphrases You Can Memorize That Even the NSA Can’t Guess • Hacker News Board

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#21

Post by feld » Fri, Mar 27, 2015, 5:02 PM UTC

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember.

  % ./passphrase.pl 10
  coppice-topped
  belly-naked
  bastard locust tree
  diamond bort
  middle-aged
  self-mapped
  air level
  field gun
  machine rifle
  chock stone
  % ./passphrase.pl 10
  self-knowing
  soul-killing
  Magna charta
  fly-killing
  spring chicken
  blotting book
  finger-cone
  gauge glass
  Fort union
  assistant examiner
  % ./passphrase.pl 10
  soya-bean oil
  foxtail pine
  island-dotted
  four-way cock
  side-bar rule
  benzoyl hydride
  straight-fibered
  steel town
  stone bramble
  rag-boiling

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#22

Post by kurotetsuka » Fri, Mar 27, 2015, 5:03 PM UTC

Here's something I wrote a little while ago - an xkcd-style passgen script in ruby. Usage is just `./passgen.rb [number of words]`. Default word count is 5.

https://github.com/kurotetsuka/passgen

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#23

Post by dghf » Fri, Mar 27, 2015, 5:08 PM UTC

A hat-tip to Arnold Reinhold, the guy behind Diceware, would have been nice. (I know the article links to the Diceware site, which gives Mr Reinhold's name at the bottom, but still ....)

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#24

Post by TheLoneWolfling » Fri, Mar 27, 2015, 5:09 PM UTC

salibhai wrote: post #3

This is actually pretty cool. From the article: Not too bad for a passphrase like “bolt vat frisky fob land hazy rigid,” which is entirely possible for most people to memorize. Compare that to “d07;oj7MgLz’%v,” a random password that contains slightly less entropy than the seven-word Diceware passphrase but is significantly more difficult to memorize. At one trillion guesses per second — per Edward Snowden’s January…

The other advantage? It's generally faster /easier for someone to type something like "bolt vat frisky fob land hazy rigid" than "d07;oj7MgLz`%v,". At least it is for me.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#25

Post by TheLoneWolfling » Fri, Mar 27, 2015, 5:10 PM UTC

feld wrote: post #21

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember. % ./passphrase.pl 10 coppice-topped belly-naked bastard locust tree diamond bort middle-aged self-mapped air…

Be careful that your "memorability" pruning doesn't reduce the entropy too much.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#26

Post by dgomez1092 » Fri, Mar 27, 2015, 5:10 PM UTC

From a UDS password framework the Dicey password generator is pretty formidable.For one things its extremley user friendly: you can memorize it easily, and there are infrequent errors attached to its usage. Deployment wise it's non-propietary software which is a plus. Lastly for security, it's easy to see that there is a big resistance to machine guessing. I liken this in intensity with an grID password, while although has a big cognitive exertion to be able to input your password within a set of grids which change, the security is high not only for machine guessing but also from internal observation since malware would be able to deduce the hash based off a new random event each time and resilient to physical observation!

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#27

Post by leshow » Fri, Mar 27, 2015, 5:11 PM UTC

(shameless plug) https://github.com/leshow/rust_mnemonic

BIP0039 has been around for a while and generates passphrases strong enough to be the seed of every private key you will ever deterministically generate in a wallet.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#28

Post by feld » Fri, Mar 27, 2015, 5:14 PM UTC

TheLoneWolfling wrote: post #25

feld wrote: post #21

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember. % ./passphrase.pl 10 coppice-topped belly-naked bastard locust tree diamond bort middle-aged self-mapped air…

Be careful that your "memorability" pruning doesn't reduce the entropy too much.

You just increase the entropy by adding characters, numbers, etc and keeping it reasonably long (20+ chars). The entropy of my passwords is quite high according to Keepass.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#29

Post by garrettr_ » Fri, Mar 27, 2015, 5:16 PM UTC

TheLoneWolfling wrote: post #24

salibhai wrote: post #3

This is actually pretty cool. From the article: Not too bad for a passphrase like “bolt vat frisky fob land hazy rigid,” which is entirely possible for most people to memorize. Compare that to “d07;oj7MgLz’%v,” a random password that contains slightly less entropy than the seven-word Diceware passphrase but is significantly more difficult to memorize. At one trillion guesses per second — per Edward Snowden’s January…

The other advantage? It's generally faster /easier for someone to type something like "bolt vat frisky fob land hazy rigid" than "d07;oj7MgLz`%v,". At least it is for me.

It's easier on keyboards (since we spend most of our time typing lowercase letters as part of text) and also on mobile (since you don't need to do annoying and error-prone context switching for capital letters or symbols).

I think this is one of the greatest unspoken benefits of Diceware-style passphrases!

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#30

Post by TheLoneWolfling » Fri, Mar 27, 2015, 5:18 PM UTC

_lce0 wrote: post #20

jmcphers wrote: post #18

Earlier quoted context omitted.

The entropy checker doesn't know about externalities like how common a word is or how likely it is to appear following some other word or how frequently it's used in passwords specifically. It's just measuring the length of the string, and probably the class from which its characters are drawn (in your case lowercase letters and spaces). Relevant Dilbert: http://dilbert.com/strip/2001-10-25

my point was using some common word on purpose, expecting it to produce a low entropy result My thinking was that "Correct Horse Battery Staple" had more entropy than: "go go go go go go go go go go go go go" .. which, apparently, is not

The problem is that it depends on your definition of the sample space. In particular if the sample space remains constant.

If your sample space is "all words in the english language, capitalized and uncapitalized", then the second one has more entropy than the first one. But if your sample space is "all characters or runs of characters that appear in the passphrase", the second one has a whole lot less entropy.