7 ms·

Visual, multi-language XKCD-style password generator

65 points by alanfranzoni 11y ago

acqq 11y ago
- It would be good to document the entropy evaluation for readers to check if the assumptions are correct. - Which random number generator is involved? Optimally, the user should be able to put his plain entropy in the locally run "nice password" maker for which he also checked the source code. Anything else, IMHO, isn't more than the game inspired by the real problem. Edit: itcrowd clears it up: it's made for April 1st, that explains the problems. - Worth knowing, a simple solution to real user-generated entropy: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html The page could be actually useful if it would run fully locally (e.g. on an air gaped computer) and take the input of the values of the user thrown dices.
jstanley 11y ago
Looks like the image search doesn't work?
- ins0 11y ago
  From the source it looks like the "feature" isn't implemented yet. Only image reference is: $('#xkcd-image-'+(index)).html(" "); This should be a "Show HN"
  - splitbrain 11y ago
    Uhh. Why post it then? Where's the innovation here?
- zapu 11y ago
  Looks like it does not work anymore. By looking at network inspector, calls to google image api return: /* callback */google.search.ImageSearch.RawCompletion('1', null, 403, 'This API is no longer available.', 200) also breakpoint in setSearchCompleteCallback shows that imageResults array is always empty.
funkyy 11y ago
Unless the test will be performed using dictionary words only. Starting with 1 word 1st capital letter followed by 1st lower case. I think the calculation time would drop significantly.
- JoshTriplett 11y ago
  Compared to brute forcing all alphanumeric passwords of the same length, true. However, even if you know the complete dictionary of 5k words this uses, 5000^4 = 625,000,000,000,000 > 2^49. Not trivial to brute force; comparable to a completely random 8-character password that uses letter, numbers, and symbols.
itcrowd 11y ago
From the previous HN thread on this: To have fun on April Fools' Day we wanted to build something useful and funny: we created a new XKCD-like password generator that can use different languages dictionaries and show a picture for each generated term by searching Google Images. We had a lot of laughs playing around with Italian and English passwords and we hope you'll have as fun with this as we did! https://news.ycombinator.com/item?id=9304688 https://news.ycombinator.com/item?id=9304688 It should be just for fun and education, anyone foolish enough to use these generated passwords as real passwords is well ... foolish enough. Flaw #1: no HTTPS.
- Udo 11y ago
  HTTPS does nothing for you in this case. The passwords are generated locally with JavaScript, and there is an option you can check to prevent them being sent back to the server. But even if they actually were generated on the server, HTTPS would be of limited use, since you'd still have to trust the server itself and the people operating it.
  - itcrowd 11y ago
    Good point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point: JavaScript injection/modification. HTTPS doesn't guarantee that the dictionary isn't flawed or the JS is secure, but it does guarantee that the received data/scripts/dictionaries are exactly the ones the server intended to send.
yummybear 11y ago
"admire fucking ali beautiful" I've already memorized it.
aargh_aargh 11y ago
Several mostly grammatical examples (English common): "catholic conversation served laughter" "zoo bearing child useless" "hitting burning psychiatrist much" "justice except critical vacation" "assigned fantastic shower interests"
minikites 11y ago
https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... > This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.
- andybak 11y ago
  4 true random choices from a dictionary of 5000 words is 50 bits of entropy. All things being equal that is just as good as any other password scheme with 50 bits of entropy. I think that's about the same as a 10 character upper/lower/numbers/symbols password. That's your worse case scenario. Add to that the fact that: a) the attacker doesn't have your dictionary b) they can't be sure you're using this method c) you might add a minor extra step of your choosing then the attack becomes significantly harder than attacking a 'normal' password with 50 bits of entropy
  - deleted 11y ago
    [deleted]
  - imaginenore 11y ago
    The attacker will naturally start with a smaller dictionary, most common words, which reduces the search space greatly. So unless you're using some of those SAT words, it's even less secure.
    - contravariant 11y ago
      5000 words is pretty small for a dictionary. Of course if you're using really simple words to make your passwords then you're out of luck, but choosing random words from a 5000 word dictionary is reasonably secure. Language contains a surprising amount of entropy, not as much as random characters, but still enough that I can be reasonably sure that this sentence is unique.
  - creshal 11y ago
    > a) the attacker doesn't have your dictionary How many truly unique sources for dictionaries are there? My own password generator simply uses `/usr/share/dict/words`, which is not that hard to guess (and documented in the generator's source code).[0] Add to this that not all languages lend themselves to this algorithm – while my native language is German, you'd need a word stem dictionary, as opposed to a regular dictionary, for this, so I stick to English dictionaries.[1] [0] I actually made it configurable, but lacking a better source, it'll probably remain at this default: https://github.com/creshal/yspave/blob/master/config.json.example#L25 https://github.com/creshal/yspave/blob/master/config.json.ex... [1] cf. http://creshal.de/News/?id=59 http://creshal.de/News/?id=59 , where I rambled on it a bit more.
merb 11y ago
A good password could be created by using a sentences with > 14 words. And than you should use the first letters in their plain form i.e. This is a sunny day will be: Tias, now you should change any s/S to a $ and any a/A to a @ after that you should add the last two bits of your birth year in fron of the sentences and the first two bits at the end of your sentences. So now you would have something like: 57Ti@$19
jve 11y ago
Serving password and copying over HTTP is actually a very bad idea. Moreover, for my language I have some non-latin symbols. I'm not sure if every service can be trusted to treat non-latin alphabet password. And this tool generates words with umlauts that we don't even have in Latvian. Some words are already translited, some not - that doesn't help.
- mollmerx 11y ago
  The passwords are generated on the client.
  - rnhmjoj 11y ago
    What if someone is listening to your traffic and injects a script which sends generated passwords to a server? http only is a bad idea in this case.
petepete 11y ago
$ shuf /usr/share/dict/words | head -n4 Zygopterides frenulum unexuberant delightsome $ wc -l /usr/share/dict/words 235886
- vive-la-liberte 11y ago
  $ # No need to use head. Also, I prefer output on one line. $ shuf -n4 /usr/share/dict/words | xargs limper mastoplastia highfaluting Bobbinite
- pavel_lishin 11y ago
  The problem with that dictionary is that it doesn't contain easy to remember words. Was my password "hospitium taxonomy pellagra" or "hospitalism taxonomy pellagra"?
dlsym 11y ago
"schatzmeister anschlägen vormarsch stolzen" Yeah. Pretty german.
james-skemp 11y ago
Nice, but I think I'll be sticking with Preshing's version. I even have my mom using it plus KeePass. My usage is to generate four words, replace a/e/I/o in one of them with 4/3/1/0, capitalize, and throw on some punctuation that makes sense. Sites with forced password limits and those that don't accept special characters are still a pain, but using dashes, capitalization, or three of the four words usually helps. http://preshing.com/20110811/xkcd-password-generator/ http://preshing.com/20110811/xkcd-password-generator/
deleted 11y ago
[deleted]
reallydontask 11y ago
it would be nice if it allowed to combine words from multiple languages. That's my technique on the websites that allow long passwords.
Ntrails 11y ago
For me, at least, I'd rather use a line of poetry that is clearly already memorised. An old router password was "It profits little an idle king, etc". (Thanks Frasier). I imagine the real winners would be older work with non-current English, or perhaps some good nonsense? Obviously when someone knows that's my thing it's easier to crack though... I shouldn't have said anything :(
- andraganescu 11y ago
  this sounds like a good idea for those folk who are walking poetry references
ollybee 11y ago
This site http://correcthorsebatterystaple.net http://correcthorsebatterystaple.net takes it's inspiration from the same XKCD cartoon It lacks the language choice but other options are more useful to me. Also the domain is easily memorable.
Rainymood 11y ago
"sexy corpse guys grunting" Hmmm ...
pavel_lishin 11y ago
I wonder where they got the commonly used word lists.
cmcginty 11y ago
Does this word list purposely choose insulting words? Out of 4 tries I was given both p&#$y and c@#t.
- Mandatum 11y ago
  Here's the 5K english wordlist file: http://password.optionfactory.net/dict/en-5k.json http://password.optionfactory.net/dict/en-5k.json Looking at the JS it doesn't appear to do it on purpose, although I did experience a similar situation. Also to add, this is probably one of those situations where a JSON file isn't really that useful. It's a wordlist that could be split by newlines or similar. There's 12 bytes needlessly added to each word when using JSON formatting (the "'s and ,'s).

65 points by alanfranzoni 11y ago

acqq 11y ago

- It would be good to document the entropy evaluation for readers to check if the assumptions are correct. - Which random number generator is involved? Optimally, the user should be able to put his plain entropy in the locally run "nice password" maker for which he also checked the source code. Anything else, IMHO, isn't more than the game inspired by the real problem. Edit: itcrowd clears it up: it's made for April 1st, that explains the problems. - Worth knowing, a simple solution to real user-generated entropy: http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html The page could be actually useful if it would run fully locally (e.g. on an air gaped computer) and take the input of the values of the user thrown dices.

jstanley 11y ago

Looks like the image search doesn't work?

ins0 11y ago
From the source it looks like the "feature" isn't implemented yet. Only image reference is: $('#xkcd-image-'+(index)).html(" "); This should be a "Show HN"
- splitbrain 11y ago
  Uhh. Why post it then? Where's the innovation here?
zapu 11y ago
Looks like it does not work anymore. By looking at network inspector, calls to google image api return: /* callback */google.search.ImageSearch.RawCompletion('1', null, 403, 'This API is no longer available.', 200) also breakpoint in setSearchCompleteCallback shows that imageResults array is always empty.

funkyy 11y ago

Unless the test will be performed using dictionary words only. Starting with 1 word 1st capital letter followed by 1st lower case. I think the calculation time would drop significantly.

JoshTriplett 11y ago
Compared to brute forcing all alphanumeric passwords of the same length, true. However, even if you know the complete dictionary of 5k words this uses, 5000^4 = 625,000,000,000,000 > 2^49. Not trivial to brute force; comparable to a completely random 8-character password that uses letter, numbers, and symbols.

itcrowd 11y ago

From the previous HN thread on this: To have fun on April Fools' Day we wanted to build something useful and funny: we created a new XKCD-like password generator that can use different languages dictionaries and show a picture for each generated term by searching Google Images. We had a lot of laughs playing around with Italian and English passwords and we hope you'll have as fun with this as we did! https://news.ycombinator.com/item?id=9304688 https://news.ycombinator.com/item?id=9304688 It should be just for fun and education, anyone foolish enough to use these generated passwords as real passwords is well ... foolish enough. Flaw #1: no HTTPS.

Udo 11y ago
HTTPS does nothing for you in this case. The passwords are generated locally with JavaScript, and there is an option you can check to prevent them being sent back to the server. But even if they actually were generated on the server, HTTPS would be of limited use, since you'd still have to trust the server itself and the people operating it.
- itcrowd 11y ago
  Good point. However, the dictionaries also need to be transferred to the user and a MITM could easily replace this with his own (flawed) dictionary. Same point: JavaScript injection/modification. HTTPS doesn't guarantee that the dictionary isn't flawed or the JS is secure, but it does guarantee that the received data/scripts/dictionaries are exactly the ones the server intended to send.

yummybear 11y ago

"admire fucking ali beautiful" I've already memorized it.

aargh_aargh 11y ago

Several mostly grammatical examples (English common): "catholic conversation served laughter" "zoo bearing child useless" "hitting burning psychiatrist much" "justice except critical vacation" "assigned fantastic shower interests"

minikites 11y ago

https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html https://www.schneier.com/blog/archives/2014/03/choosing_secu... > This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.

andybak 11y ago
4 true random choices from a dictionary of 5000 words is 50 bits of entropy. All things being equal that is just as good as any other password scheme with 50 bits of entropy. I think that's about the same as a 10 character upper/lower/numbers/symbols password. That's your worse case scenario. Add to that the fact that: a) the attacker doesn't have your dictionary b) they can't be sure you're using this method c) you might add a minor extra step of your choosing then the attack becomes significantly harder than attacking a 'normal' password with 50 bits of entropy
- deleted 11y ago
  [deleted]
- imaginenore 11y ago
  The attacker will naturally start with a smaller dictionary, most common words, which reduces the search space greatly. So unless you're using some of those SAT words, it's even less secure.
  - contravariant 11y ago
    5000 words is pretty small for a dictionary. Of course if you're using really simple words to make your passwords then you're out of luck, but choosing random words from a 5000 word dictionary is reasonably secure. Language contains a surprising amount of entropy, not as much as random characters, but still enough that I can be reasonably sure that this sentence is unique.
- creshal 11y ago
  > a) the attacker doesn't have your dictionary How many truly unique sources for dictionaries are there? My own password generator simply uses `/usr/share/dict/words`, which is not that hard to guess (and documented in the generator's source code).[0] Add to this that not all languages lend themselves to this algorithm – while my native language is German, you'd need a word stem dictionary, as opposed to a regular dictionary, for this, so I stick to English dictionaries.[1] [0] I actually made it configurable, but lacking a better source, it'll probably remain at this default: https://github.com/creshal/yspave/blob/master/config.json.example#L25 https://github.com/creshal/yspave/blob/master/config.json.ex... [1] cf. http://creshal.de/News/?id=59 http://creshal.de/News/?id=59 , where I rambled on it a bit more.

merb 11y ago

A good password could be created by using a sentences with > 14 words. And than you should use the first letters in their plain form i.e. This is a sunny day will be: Tias, now you should change any s/S to a $ and any a/A to a @ after that you should add the last two bits of your birth year in fron of the sentences and the first two bits at the end of your sentences. So now you would have something like: 57Ti@$19

jve 11y ago

Serving password and copying over HTTP is actually a very bad idea. Moreover, for my language I have some non-latin symbols. I'm not sure if every service can be trusted to treat non-latin alphabet password. And this tool generates words with umlauts that we don't even have in Latvian. Some words are already translited, some not - that doesn't help.

mollmerx 11y ago
The passwords are generated on the client.
- rnhmjoj 11y ago
  What if someone is listening to your traffic and injects a script which sends generated passwords to a server? http only is a bad idea in this case.

petepete 11y ago

$ shuf /usr/share/dict/words | head -n4 Zygopterides frenulum unexuberant delightsome $ wc -l /usr/share/dict/words 235886

vive-la-liberte 11y ago
$ # No need to use head. Also, I prefer output on one line. $ shuf -n4 /usr/share/dict/words | xargs limper mastoplastia highfaluting Bobbinite
pavel_lishin 11y ago
The problem with that dictionary is that it doesn't contain easy to remember words. Was my password "hospitium taxonomy pellagra" or "hospitalism taxonomy pellagra"?

dlsym 11y ago

"schatzmeister anschlägen vormarsch stolzen" Yeah. Pretty german.

james-skemp 11y ago

Nice, but I think I'll be sticking with Preshing's version. I even have my mom using it plus KeePass. My usage is to generate four words, replace a/e/I/o in one of them with 4/3/1/0, capitalize, and throw on some punctuation that makes sense. Sites with forced password limits and those that don't accept special characters are still a pain, but using dashes, capitalization, or three of the four words usually helps. http://preshing.com/20110811/xkcd-password-generator/ http://preshing.com/20110811/xkcd-password-generator/

deleted 11y ago

[deleted]

reallydontask 11y ago

it would be nice if it allowed to combine words from multiple languages. That's my technique on the websites that allow long passwords.

Ntrails 11y ago

For me, at least, I'd rather use a line of poetry that is clearly already memorised. An old router password was "It profits little an idle king, etc". (Thanks Frasier). I imagine the real winners would be older work with non-current English, or perhaps some good nonsense? Obviously when someone knows that's my thing it's easier to crack though... I shouldn't have said anything :(

andraganescu 11y ago
this sounds like a good idea for those folk who are walking poetry references

ollybee 11y ago

This site http://correcthorsebatterystaple.net http://correcthorsebatterystaple.net takes it's inspiration from the same XKCD cartoon It lacks the language choice but other options are more useful to me. Also the domain is easily memorable.

Rainymood 11y ago

"sexy corpse guys grunting" Hmmm ...

pavel_lishin 11y ago

I wonder where they got the commonly used word lists.

cmcginty 11y ago

Does this word list purposely choose insulting words? Out of 4 tries I was given both p&#$y and c@#t.

Mandatum 11y ago
Here's the 5K english wordlist file: http://password.optionfactory.net/dict/en-5k.json http://password.optionfactory.net/dict/en-5k.json Looking at the JS it doesn't appear to do it on purpose, although I did experience a similar situation. Also to add, this is probably one of those situations where a JSON file isn't really that useful. It's a wordlist that could be split by newlines or similar. There's 12 bytes needlessly added to each word when using JSON formatting (the "'s and ,'s).