Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI-generated password isn't random, it just looks that way

theregister.com

Post reply on HN
Print view View original

11–20 of 25 posts

Re: AI-generated password isn't random, it just looks that way

#11

Post by nextaccountic »

altmanaltman wrote: post #3

Nothing about LLMs is random, how is this not common sense? If you prompt it the same prompt 50 times, it'll always converge towards the most plausible answer in its training based on probability, and most of them will follow the first pattern. The paper mentions using different chats for each of the 50 prompts and using the first password suggested and then finding similarities between them. Would it be the same if…

harnesses could just have a tool call that samples from /dev/random or something

Re: AI-generated password isn't random, it just looks that way

#12

Post by AStrangeMorrow »

Revisional_Sin wrote: post #2

Not surprising at all if you've used LLMs to generate fiction; they always choose the same few names.

Yeah for having tried a few times, they only relative successes I had was having some World engine to manage the structure and style (generates character names and relationships, places names and location, biomes, objects, tracking world state etc). And the LLM is just here to expand on all that, create the flow etc

Re: AI-generated password isn't random, it just looks that way

#13

Post by jonas21 »

If you say: "Generate a strong password", then Claude will do what's reported in the article.

If you say: "Generate a strong password using Python", then Claude will write code using the `secrets` module, execute it, and report the result, and you'll actually get a strong password.

To get good results out of an LLM, it's helpful to spend a few minutes understanding how they (currently) work. This is a good example because it's so simple.

Re: AI-generated password isn't random, it just looks that way

#14

Post by [deleted] »

jonas21 wrote: post #13

If you say: "Generate a strong password", then Claude will do what's reported in the article. If you say: "Generate a strong password using Python", then Claude will write code using the `secrets` module, execute it, and report the result, and you'll actually get a strong password. To get good results out of an LLM, it's helpful to spend a few minutes understanding how they (currently) work. This is a good example be…

[deleted]

Re: AI-generated password isn't random, it just looks that way

#15

Post by aix1 »

jonas21 wrote: post #13

If you say: "Generate a strong password", then Claude will do what's reported in the article. If you say: "Generate a strong password using Python", then Claude will write code using the `secrets` module, execute it, and report the result, and you'll actually get a strong password. To get good results out of an LLM, it's helpful to spend a few minutes understanding how they (currently) work. This is a good example be…

I think that "Generate a strong password" is a pretty clear and unambiguous instruction. Generating a password that can be easily recovered is a clear failure to follow that instruction.

Given that Claude already has the ability to write and execute code, it's not obvious to me why it should, in principle, need an explicit nudge. Surely it could just fulfil the first request exactly like it fulfils the second.

Re: AI-generated password isn't random, it just looks that way

#17

Post by plagiarist »

aix1 wrote: post #15
jonas21 wrote: post #13

If you say: "Generate a strong password", then Claude will do what's reported in the article. If you say: "Generate a strong password using Python", then Claude will write code using the `secrets` module, execute it, and report the result, and you'll actually get a strong password. To get good results out of an LLM, it's helpful to spend a few minutes understanding how they (currently) work. This is a good example be…

I think that "Generate a strong password" is a pretty clear and unambiguous instruction. Generating a password that can be easily recovered is a clear failure to follow that instruction. Given that Claude already has the ability to write and execute code, it's not obvious to me why it should, in principle, need an explicit nudge. Surely it could just fulfil the first request exactly like it fulfils the second.

It's not actually thinking, though. There's no way for it to "know" it will be wrong because it wasn't trained on content covering that.

Maybe in the future companies making the models will train them specifically on when to require a source of true randomness and they might start writing code for it.

Re: AI-generated password isn't random, it just looks that way

#20

Post by Bender »

jmclnx wrote: post #4

FWIW, you can generate your own random PW on any UN*X Type system, I think on MACs also: For example: tr -cd "[:alnum:]" Change "alnum" to "print" to get other characters. This will generate 10 20 characters passwords.

    shuf -i 1-10 -n1
    10

    shuf -n1 /usr/share/dict/usa 
    saltier

    # random 24 char
    base64 /dev/urandom | tr -d '/+' | dd bs=24 count=1 2>/dev/null;echo
    5seFtWG09vTUc0VCMb3BJ6Al

    # random letter
    base64 /dev/urandom | tr -d '/+' | sed s/[^[:alpha:]]//g | tr 'A-Z' 'a-z' | dd bs=1 count=1 2>/dev/null;echo
    x

    # bash
    echo $RANDOM
    21178
Post reply on HN