Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Correct Horse Battery Staple: Secure Password Generator

correcthorsebatterystaple.net

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Correct Horse Battery Staple: Secure Password Generator

#31

Post by macrael »

hn_throwaway_99 wrote: post #26

This goes against the whole idea of that XKCD comic. If you want to come up with a password you can remember , you should string together a bunch of words that make sense to you . But if you want a password you can remember, randomly generating it (especially in a way that has low overall entropy per the current top comment) seems like a bad way to do it. IMO the days of remembering multiple passwords are gone - eith…

The XKCD comic was absolutely about randomly generating a four word password, not picking four words that mean something to you. That's how the math works is if each word is random.

Re: Correct Horse Battery Staple: Secure Password Generator

#32

Post by adzm »

dragontamer wrote: post #30
tomxor wrote: post #21

Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…

Well, you only need one six-sided die really. It's really fun to do as well. I highly recommend the EFF wordlist though.

Re: Correct Horse Battery Staple: Secure Password Generator

#33

Post by User23 »

thfuran wrote: post #11
bartvk wrote: post #9

There are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/

Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.

Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.

Re: Correct Horse Battery Staple: Secure Password Generator

#34

Post by shadowgovt »

tikkun wrote: post #4

Would be neat if it had stable diffusion powered image generation, to help people visualize and remember their passwords.

Memory's a real issue. In principle this is a nice demo; in practice I will be able to retain like five to seven of these high-entropy blobs before they all run together.

The fundamental problem with passwords is still the need for them.

Re: Correct Horse Battery Staple: Secure Password Generator

#36

Post by shadowgovt »

etrautmann wrote: post #16
rootusrootus wrote: post #13

At this point, average users are better off with a password manager and/or passkeys. The fraction of users willing to learn more than one decent password and not use it in multiple places is probably 1% or less.

Yes, but this is a great way to create a master password for your manager

"Correct horse battery staple?! That's amazing. I've got the same password on my luggage."

Re: Correct Horse Battery Staple: Secure Password Generator

#37

Post by forgetfulness »

shadowgovt wrote: post #34
tikkun wrote: post #4

Would be neat if it had stable diffusion powered image generation, to help people visualize and remember their passwords.

Memory's a real issue. In principle this is a nice demo; in practice I will be able to retain like five to seven of these high-entropy blobs before they all run together. The fundamental problem with passwords is still the need for them.

You only really need three passwords, four at most; for your own computer, your own email, your password manager, probably your work computer.

Have a passphrase for each and let the password manager generate noise for everything else.

Re: Correct Horse Battery Staple: Secure Password Generator

#38

Post by Imnimo »

dragontamer wrote: post #30
tomxor wrote: post #21

Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…

I feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.

Re: Correct Horse Battery Staple: Secure Password Generator

#39

Post by walrus01 »

tomxor wrote: post #21

Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful

on debian, 'sudo apt install pwgen'

pwgen with the -s option will generate 'random' passwords, up to the randomness limit of whatever random source is provided by your kernel and system.

https://packages.debian.org/search?keywords=pwgen

Post reply on HN