Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Correct Horse Battery Staple: Secure Password Generator

correcthorsebatterystaple.net

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Correct Horse Battery Staple: Secure Password Generator

#51

Post by tomxor »

dragontamer wrote: post #30
tomxor wrote: post #21

Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…

> The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself.

I'm just a humble non-crytographic-programmer making practical suggestions with the most substantial security improvement for the least effort... Of course personally - I roll dice, dice that I whittled out of sticks, sticks from different trees that I collected from different parks, parks that I visited in a random order based on the results of a PRNG of my own secret design, a PRNG I built out of swarm crab based logic gates on a secret beach, seeded with a number collected from a geiger counter and small sample of u238, a geiger counter I constructed from photodiodes and aluminium foil, photodiodes I fabricated out of mud, rocks and fire. One day I hope to finish implementing my own general purpose computer and browser, then I will finally be able to use my passwords :)

Re: Correct Horse Battery Staple: Secure Password Generator

#53

Post by [deleted] »

tomxor wrote: post #51
dragontamer wrote: post #30

Earlier quoted context omitted.

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…

> The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. I'm just a humble non-crytographic-programmer making practical suggestions with the most substantial security improvement for the least effort... Of course personally - I roll dice, dice that I whittled out of sticks, sticks from different trees that I collected from different parks, parks that I visited…

[deleted]

Re: Correct Horse Battery Staple: Secure Password Generator

#54

Post by dragontamer »

tomxor wrote: post #51
dragontamer wrote: post #30

Earlier quoted context omitted.

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist ( https://theworld.com/~reinhold/diceware.wordlist.a…

> The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. I'm just a humble non-crytographic-programmer making practical suggestions with the most substantial security improvement for the least effort... Of course personally - I roll dice, dice that I whittled out of sticks, sticks from different trees that I collected from different parks, parks that I visited…

Well, there's questions like why use 6^5 (46656) words if you're just not going to be rolling six-sided dice? There are other wordlists and dictionaries out there.

For example, randomly selecting words from the Basic English Wordlist (https://simple.wikipedia.org/wiki/Wikipedia:Basic_English_co...), a list of 2626 words, could be a better methodology.

Re: Correct Horse Battery Staple: Secure Password Generator

#55

Post by rootusrootus »

etrautmann wrote: post #16
rootusrootus wrote: post #13

At this point, average users are better off with a password manager and/or passkeys. The fraction of users willing to learn more than one decent password and not use it in multiple places is probably 1% or less.

Yes, but this is a great way to create a master password for your manager

I generally agree. I've used an XKCD-style password for a long time for my 1Password master password. But it does have downsides -- on a mobile device, it's a lot of typing, if you need to enter it.

Re: Correct Horse Battery Staple: Secure Password Generator

#56

Post by fanf2 »

Symbiote wrote: post #18
personjerry wrote: post #7

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

)=*vZqV Grateful-Afternoon-Resistance-South-0 The second is much easier to remember, and common security measures need to be practical. Incidentally, I have two small shell functions to generate these. Tweaked slightly:

You should not have to remember more than 2 or 3 passwords, enough to log in to your main computers and password managers. If you have few enough passwords that you use frequently enough, they can be completely random, and there is no need to get creative with “memorable” generation schemes.

Re: Correct Horse Battery Staple: Secure Password Generator

#57

Post by thfuran »

User23 wrote: post #33
thfuran wrote: post #11

Earlier quoted context omitted.

Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.

Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.

A password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.

Re: Correct Horse Battery Staple: Secure Password Generator

#58

Post by _kst_ »

Like many others, I've written my own correct-horse-battery-staple-based passphrase generator.

"gen-password" generates random passwords, allowing your to specify length and character set.

"gen-passphrase" generates correct-horse-battery-staple-style passphrases.

Both are written in Perl, using /dev/urandom by default for randomness.

https://github.com/Keith-S-Thompson/random-passwords

Re: Correct Horse Battery Staple: Secure Password Generator

#59

Post by User23 »

thfuran wrote: post #57
User23 wrote: post #33

Earlier quoted context omitted.

Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.

A password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.

Sure, but I thought it was obvious you wouldn't use one word. I'm saying a six megabyte file plus a one line shell script is enough to generate secure passwords with just four words by producing something like "Gargantuan Lackadaisical Lugubrious Flibbertigibbet" which while a bit of a mouthful isn't terribly difficult to memorize compared to 76 bits of line noise or even base64.

Re: Correct Horse Battery Staple: Secure Password Generator

#60

Post by AviationAtom »

It's been noted elsewhere in the comments, but I think it's worth pointing out that 1Password incorporates a similar algorithm for random password generation. It allows you to configure a series of uppercase words, lowercase words, special characters, and numbers. i.e. CAR-horse7ambulance
Post reply on HN