Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd Password Generator

preshing.com

Post reply on HN
Print view View original

11–20 of 299 posts

Re: Xkcd Password Generator

#11

Post by pilif »

Assuming that this method for generating passwords gets popular enough, brute force tools will begin to create an optimized attack for these passwords.

As there are so little words available, if I were to write a brute-forcing tool, I would try combinations of four words in my wordlist once I failed with my one-word-dictionary attack before I start trying out all characters.

But all is not lost: Either use more words or vary the amount of spaces you put between words. This way the dumb optimization "try four words delimited by space" wouldn't work on your password and they would have to go over to plain old brute forcing at which point, I agree, the longer, the better.

Re: Xkcd Password Generator

#12

Post by iaskwhy »

I always thought using two password fields with simple words would be much harder to break than one field only (which can be used to really strange passwords but also for simples ones as we all know). Someone care to calculate how much it would take to break it?

Re: Xkcd Password Generator

#13

Post by buro9 »

petenixey wrote: post #8
buro9 wrote: post #4

Earlier quoted context omitted.

I've also been doing this for years, but with bits of my post code thrown in to fulfil those edqe cases where complexity requirements are needed.

... random combinations of bike bits plus a greater London post code. Give me enough monkeys and typewriters and I could take you ;)

nah, my typos will laways protect me

Re: Xkcd Password Generator

#14

Post by corin_ »

iaskwhy wrote: post #12

I always thought using two password fields with simple words would be much harder to break than one field only (which can be used to really strange passwords but also for simples ones as we all know). Someone care to calculate how much it would take to break it?

Well it depends how it's stored, but assuming a fairly standard setup it wouldn't particularly help.

The main issue with website security isn't people brute forcing the website login box, it's people cracking the hashes after stealing them. So if you had two easy to crack hashes stored in the database, you crack them both and off you go.

Re: Xkcd Password Generator

#15

Post by burgerbrain »

pilif wrote: post #11

Assuming that this method for generating passwords gets popular enough, brute force tools will begin to create an optimized attack for these passwords. As there are so little words available, if I were to write a brute-forcing tool, I would try combinations of four words in my wordlist once I failed with my one-word-dictionary attack before I start trying out all characters. But all is not lost: Either use more words…

https://secure.wikimedia.org/wikipedia/en/wiki/Diceware

Properly executed, this will protect you against brute force attacks. No need to do nonsense like adding more spaces.

Of course XKCD botched it and said an inadequate minimum length...

Notable quote from the article: "This level of unpredictability assumes that a potential attacker knows both that Diceware has been used to generate the passphrase, the particular word list used, and exactly how many words make up the passphrase."

Re: Xkcd Password Generator

#16

Post by jsulak »

I prefer using a program like Password Safe (http://passwordsafe.sourceforge.net/), and use a safe password that's a long sentence (with punctuation). Then I can use arbitrarily long and complex passwords for all my accounts, and not have to worry about memorizing them individually. The password safe can even be synced across computers using Dropbox.

Re: Xkcd Password Generator

#17

Post by darklajid »

ErrantX wrote: post #10

Not a good idea, sadly. In fact I'd go so far to say this is a really bad suggestion ; because it gives a false sense of security. There is potentially a lot less entropy in this password than "Tr0ub4d0r&3", assuming the hacker is smart enough to realise he can trivially test combinations of dictionary words in very short amount of time. (EDIT: I'm way out of touch with this; it's not as trivial as perhaps I figured.…

> he can trivially test combinations of dictionary words in very short amount of time.

Explain the reasoning behind this, please.

Start with: You don't know the dictionary I used, but have to use one that seems 'good enough' (i.e. a superset of mine, if possible).

How many words are in there?

How many combinations can you create for 'two word phrases'? (You don't know the length of my phrase)

How many for three?

How many for four words?

Re: Xkcd Password Generator

#18

Post by ZoFreX »

I would actually advise going against this advice. While it isn't a best practice, password sharing can and does happen, as does shoulder-surfing. It would take a LOT of effort to memorise my password, but a simple four word password will probably be remembered by accident. In a year's time if I piss a friend off, I don't want my Facebook password to be readily accessible in their memory.

I think more people need to learn to remember arbitrary strings. There really is no way around that problem if you want a decently secure password, and it's rare someone has a "good memory" - in most cases they've just learnt how to remember things well.

(Note: This doesn't really apply to me or most of us here in most cases, but for example my WiFi password is of the form "Mycatsname9" and yet my neighbour still has to ask me for it whenever her phone forgets it)

Re: Xkcd Password Generator

#19

Post by darklajid »

burgerbrain wrote: post #15
pilif wrote: post #11

Assuming that this method for generating passwords gets popular enough, brute force tools will begin to create an optimized attack for these passwords. As there are so little words available, if I were to write a brute-forcing tool, I would try combinations of four words in my wordlist once I failed with my one-word-dictionary attack before I start trying out all characters. But all is not lost: Either use more words…

https://secure.wikimedia.org/wikipedia/en/wiki/Diceware Properly executed, this will protect you against brute force attacks. No need to do nonsense like adding more spaces. Of course XKCD botched it and said an inadequate minimum length... Notable quote from the article: "This level of unpredictability assumes that a potential attacker knows both that Diceware has been used to generate the passphrase, the particular…

Was just about to quote that to you. Don't you think that you should take this quote into account when you say xkcd botched it?
Post reply on HN