Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passphrases You Can Memorize That Even the NSA Can’t Guess

firstlook.org

Post reply on HN
Print view View original

51–57 of 57 posts

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#51

Post by digitalpacman »

salibhai wrote: post #3

This is actually pretty cool. From the article: Not too bad for a passphrase like “bolt vat frisky fob land hazy rigid,” which is entirely possible for most people to memorize. Compare that to “d07;oj7MgLz’%v,” a random password that contains slightly less entropy than the seven-word Diceware passphrase but is significantly more difficult to memorize. At one trillion guesses per second — per Edward Snowden’s January…

I actually can remember a password like the d07 one easier because of keyboard pattern matching. That's how I generate passwords is I draw patterns on the keyboard. It's so unpopular that nobody creates tables for keyboard patterns entries.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#52

Post by SchizoDuckie »

digitalpacman wrote: post #50

Sadly doesn't work ever because of internet enforced password length and character pattern requirements.

So much this.

You can think of a great passwords scheme for yourself, and then find yourself in a pool of shit where hotmail asks you to have maximum 12 characters in a password, facebook requires you use a number, but it can be up to 40 characters, amazon wants you to use a special character like an @ or a # and but has a max length of 15 so on and so on.

Passwords. Suck. Use a password manager that autogenerates and autostores it like lastpass.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#53

Post by feld »

tedunangst wrote: post #37
feld wrote: post #21

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember. % ./passphrase.pl 10 coppice-topped belly-naked bastard locust tree diamond bort middle-aged self-mapped air…

Not that odd. All the words from Webster's are in web2, all the compound entries (not strictly "words") are in web2a. That said, "straight-fibered four-way cock" is my new favorite passphrase.

So that explains where they were sourced from. Thanks!

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#54

Post by abandonliberty »

bradleyjg wrote: post #46
abandonliberty wrote: post #41

Earlier quoted context omitted.

Interesting, I really like your approach to this. If we go back to the original 'song verse' idea, the space of all valid/written phrases is much smaller than the space of all possible word combinations. It's vulnerable to dictionary attacks based on commonly chosen phrases and frequency of phrase use in language/culture. Wikipedia only has 2.4 billion words, out of an estimated billion English words [1]. Perhaps we…

This is the more usual objection that I was referring to with Kolmogorov complexity. Forty random digits has very decent entropy, 40 digits of PI, though they look very random, has much less. From that you can see how it's really hard to quantify exactly how much entropy there is an song verse that exists somewhere on the internet. If you wanted an absolute ranking of password strength, you'd first want to construct…

We should be able to at least estimate an upper bound.

If wikipedia has 2.5B words, let's generously assume 10B words. Let's allow phrase lengths of 1-10 words and arrive at 100B combinations.

Optimistically we're at 37 bits, not even a 7 character [a-zA-Z0-9!@#$%^&()].

And unlike the [a-zA-Z0-9!@#$%^&*()], we could madly cut that down based on frequency and popularity.

Therefore existing phrase passwords are security through minority. If they are adopted, they provide at best an order of magnitude or two over simple dictionary words.

But we're kidding ourselves, most people still use 'password'.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#55

Post by jrapdx3 »

feld wrote: post #21

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember. % ./passphrase.pl 10 coppice-topped belly-naked bastard locust tree diamond bort middle-aged self-mapped air…

Using web2a is a great idea. I'd written a Diceware-like password generator in Scheme. The word word list was derived from the web2 list (FreeBSD /usr/share/dict directory). Even after paring it down to ~151000 items, the resulting passwords often contained arcane terms limiting password usability.

With the web2a list slightly tweaked, I get many memorable passwords, e.g., "power-weaver-sand-screw-1081" or "cloud-ring-tea-fighting-1107". OTOH web2a is shorter (~76000 entries), giving 2 bits less entropy vs. using the filtered web2 list. Taking password readability into account, the higher rate of "keepers" with web2a probably evens out the difference.

BTW the web2a word list is here (https://svnweb.freebsd.org/base/head/share/dict) in case anyone doesn't have access to it.

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#56

Post by beltorak »

digitalpacman wrote: post #51
salibhai wrote: post #3

This is actually pretty cool. From the article: Not too bad for a passphrase like “bolt vat frisky fob land hazy rigid,” which is entirely possible for most people to memorize. Compare that to “d07;oj7MgLz’%v,” a random password that contains slightly less entropy than the seven-word Diceware passphrase but is significantly more difficult to memorize. At one trillion guesses per second — per Edward Snowden’s January…

I actually can remember a password like the d07 one easier because of keyboard pattern matching. That's how I generate passwords is I draw patterns on the keyboard. It's so unpopular that nobody creates tables for keyboard patterns entries.

I created an account just for you....

https://github.com/Rich5/Keyboard-Walk-Generators

Re: Passphrases You Can Memorize That Even the NSA Can’t Guess

#57

Post by beltorak »

pgalland wrote: post #47

The official website of Diceware does not have a certificate http://world.std.com/~reinhold/diceware.html Is it intentional ? The word list is signed but for someone unfamiliar with crypto an electronic signature is useless while a lock in the address bar is reassuring.

while true, the nice thing about the diceware wordlists is you can scan them. The only thing that would lower the entropy is if there were duplicated words. The lists are in alphabetic and numeric order.
Post reply on HN