Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPass – Hate passwords, love passphrases

wordpass.io

Post reply on HN
Print view View original

31–40 of 52 posts

Re: WordPass – Hate passwords, love passphrases

#31

Post by ChikkaChiChi »

chimeracoder wrote: post #27

I support the conclusion of this XKCD comic, but the math always seemed off to me. Lets say your dictionary has 100,000 words[0], and your attacker has access to the same list. If the attacker knows that you have chosen four words off of that list, he still only has a 1/4,166,416,671,249,975,000 chance of guessing the right permutation (not combination!). That's less than 2^61, which is certainly very secure. However…

If you compare the number of possibilities per word versus the number of possibilities per character (94 on the commonly used ASCII spectrum for US keyboards), the benefits are clear.

That's not to say that it's impenetrable. It's just making it less convenient to crack which seems to be the name of the security game.

Re: WordPass – Hate passwords, love passphrases

#32

Post by zokier »

chimeracoder wrote: post #27

I support the conclusion of this XKCD comic, but the math always seemed off to me. Lets say your dictionary has 100,000 words[0], and your attacker has access to the same list. If the attacker knows that you have chosen four words off of that list, he still only has a 1/4,166,416,671,249,975,000 chance of guessing the right permutation (not combination!). That's less than 2^61, which is certainly very secure. However…

> However, the entropy calculation in the XKCD comic assumes that the characters are uncorrelated with each other, the way they would be if you used a totally random password.

No. A word picked from 2048 word dictionary has 11 bits of entropy, that is where XKCD gets its 44 bits of entropy for four words.

Re: WordPass – Hate passwords, love passphrases

#33

Post by IanDrake »

Security concerns aside, I don't get it...

It generated "enterlongrangealfredgreeted". How does that help me? I haven't seen a site that would allow for a password like this in a long time. It's too long, it doesn't have at least one cap, one number, and one symbol. So, what good would this do?

Re: WordPass – Hate passwords, love passphrases

#34

Post by zokier »

IanDrake wrote: post #33

Security concerns aside, I don't get it... It generated "enterlongrangealfredgreeted". How does that help me? I haven't seen a site that would allow for a password like this in a long time. It's too long, it doesn't have at least one cap, one number, and one symbol. So, what good would this do?

> I haven't seen a site that would allow for a password like this in a long time.

I'm pretty sure you are looking at one right now.

Re: WordPass – Hate passwords, love passphrases

#35

Post by discreditable »

nikcub wrote: post #26

or shell alias: cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"tolower($0)}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " suggestion would be to find a better word list than the default aspell since that is the entire Oxford dictionary, which isn't as memorable (although it is an interesting way to learn about new words).

Also contains explicit words. Doesn't stop me from using it for myself, but it's not helpful if you are looking to generate passwords for others.

Re: WordPass – Hate passwords, love passphrases

#36

Post by __david__ »

IanDrake wrote: post #33

Security concerns aside, I don't get it... It generated "enterlongrangealfredgreeted". How does that help me? I haven't seen a site that would allow for a password like this in a long time. It's too long, it doesn't have at least one cap, one number, and one symbol. So, what good would this do?

Really? 90% of sites I run into don't have those restrictions.

Re: WordPass – Hate passwords, love passphrases

#37

Post by seventytwo »

chimeracoder wrote: post #27

I support the conclusion of this XKCD comic, but the math always seemed off to me. Lets say your dictionary has 100,000 words[0], and your attacker has access to the same list. If the attacker knows that you have chosen four words off of that list, he still only has a 1/4,166,416,671,249,975,000 chance of guessing the right permutation (not combination!). That's less than 2^61, which is certainly very secure. However…

What common user do you know of that has a 100,000 word vocabulary? My point being that a list of the 10,000 most commonly used words would most likely be sufficient to cover most combinations of pass phrases.

Re: WordPass – Hate passwords, love passphrases

#38

Post by __david__ »

nikcub wrote: post #26

or shell alias: cat /usr/share/dict/words | awk 'BEGIN{srand();}{print rand()"\t"tolower($0)}' | sort -k1 -n | cut -f2 | head -n 4 | tr "\\n" " " suggestion would be to find a better word list than the default aspell since that is the entire Oxford dictionary, which isn't as memorable (although it is an interesting way to learn about new words).

Or, if you have GNU coreutils installed (on linux, for example):

    shuf -n 4 /usr/share/dict/words

Re: WordPass – Hate passwords, love passphrases

#39

Post by Kluny »

__david__ wrote: post #36
IanDrake wrote: post #33

Security concerns aside, I don't get it... It generated "enterlongrangealfredgreeted". How does that help me? I haven't seen a site that would allow for a password like this in a long time. It's too long, it doesn't have at least one cap, one number, and one symbol. So, what good would this do?

Really? 90% of sites I run into don't have those restrictions.

The sites where you care the most about security do: Ebay, PayPal, my bank, all government websites (Canada).

Re: WordPass – Hate passwords, love passphrases

#40

Post by paul_f »

seventytwo wrote: post #37
chimeracoder wrote: post #27

I support the conclusion of this XKCD comic, but the math always seemed off to me. Lets say your dictionary has 100,000 words[0], and your attacker has access to the same list. If the attacker knows that you have chosen four words off of that list, he still only has a 1/4,166,416,671,249,975,000 chance of guessing the right permutation (not combination!). That's less than 2^61, which is certainly very secure. However…

What common user do you know of that has a 100,000 word vocabulary? My point being that a list of the 10,000 most commonly used words would most likely be sufficient to cover most combinations of pass phrases.

It would seem that word length is important too. Between 5 and 8 characters. Wouldn't that drop in half the size of the vocabulary?
Post reply on HN