4 ms·

I'm not sure when/how but all the newer wifi home systems I've seen prompt people's devices to share the password when someone tries to join. So you can have a

I'm not sure when/how but all the newer wifi home systems I've seen prompt people's devices to share the password when someone tries to join. So you can have a complex password. Also a lot of those have guest networks so if you need a week network you can have them. Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" - doesn't have to be complex.

jdwithit 8y ago
This is a feature of iOS and macOS, at least. If you have a wifi network's password saved in your device, you can bring it physically close to another device that doesn't and it will ask whether you want to share. You have to affirm you want to give them the login before it will happen. Very handy when traveling as only one person in the group has to find and (mis)type the password :)
lucb1e 8y ago
> Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" No, no, no. The rest of your comment is spot-on, but I've done projects on passphrases and everyone gets this backwards. That is not what XKCD says. Let me quote the XKCD: > four random common words Random words, not a phrase like "may the force be with" and "my friend mark" (I'm sure you can find those two online). When cracking public hash dumps using phrases from public sources, I get hundreds of thousands of hits. If your phrase (partially) exists online, it's not a secret one. Someone else mentioned diceware. Six random words from that dictionary (potentially generated using real dice) is pretty much unbreakable, though it has only a small security margin for when a protocol gets weakened but not broken.
- dogma1138 8y ago
  These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most common English words, if leetspeak substitution is used you can also easily mask it. We did this experiment and even randomly generating 6 word passwords using Wikipedia as dictionary resulted in passwords which are faster to crack than 16 character randomly generated passwords and that is because you can’t count the entropy as single characters sure if you brute force it char by char it will take longer but if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.
  - lucb1e 8y ago
    > These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. There is no fundamental difference. Either your pool of elements consists of 95 different symbols (ASCII printable characters and space) and you get passwords like 'F~iV3Bcv>\Q@' or your pool of elements consists of thousands of words and you get passwords like 'hubs exempted contend catchment others'. As per Kerckhoff's principle, we should assume that the method of generating the password is known (which set of elements, i.e. your charset or dictionary, which RNG was used, and perhaps the length of the password). The resulting strength in terms of bruteforceability of its hash is equal. Assuming one picks sane values, e.g. 6 elements when using a 7800 element set, or 12 elements when using a 95 element set, both are safe to use. > randomly generating 6 word passwords using Wikipedia as dictionary I don't understand what you mean by "using Wikipedia as dictionary". Wikipedia contains whole sentences. Did you download a dump of the English Wikipedia and split it on non-word characters and use that as dictionary? Did you remove duplicate words? Or did you take Wiktionary's words? > if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. I think you're wrong, but feel free to prove me wrong :). Here are some hashes: f4cd51713a3ac5798b3a0b40fe61aa2f f424f3432b7acbce2c2d3548490c9cc0 71fa597116bfc54ecc6c48162629d391 beb09edbc493bf826b61afa6905712df 42251a29996a78ef023bdb03a8c22ea9 3a80f15bd82c4f4c0a3338a1fa86adb9 They were generated using this script: function genphrase { x=$1; while [ $x -gt 0 ]; do echo -n $(shuf /usr/share/dict/words | grep -v é | grep -v \' | tail -1)\ ; let x=$x-1; done; } for i in {1..6}; do phrase="$(genphrase $i)"; sum=$(echo -n "$phrase" | md5sum | awk '{print $1}'); echo "$sum $phrase"; done; Basically I take random words from /usr/share/dict/words so long as it does not contain an apostrophe or an accented e. The md5 hash of the result is generated, a very fast and well-supported algorithm (your favorite cracking program should support it without any trouble). As an example, from another run of the script, here is one of its output lines: 75e6881687661e09e404b517e7ee2ce3 goodliest villeins gymnast You can use this sample output to verify that the hash is generated correctly and that your tool works. I expect the first two hashes should not be an issue, the third might be harder, the fourth would be impressive, and I expect that the fifth and sixth will remain uncracked. The dictionary version is 2018.04.16-1 (wamerican package in Debian), I uploaded it here: https://lucb1e.com/tmp/words https://lucb1e.com/tmp/words (watch out clicking the link, it's a large file and your browser may just display it instead of downloading it) > You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine. At least in my research, I've found that markov chains and n-grams are of much worse quality and slower than just using raw phrases from public sources. The downloading and processing of those sources takes more time, but that's a one-time action and not really part of the cracking process. And as I said in the comment you're replying to, if your 'phrase' is not random words but actually a logical 'phrase', then it's not suitable as passphrase. I think you're confusing random phrases with logical sentences.

jdwithit 8y ago

This is a feature of iOS and macOS, at least. If you have a wifi network's password saved in your device, you can bring it physically close to another device that doesn't and it will ask whether you want to share. You have to affirm you want to give them the login before it will happen. Very handy when traveling as only one person in the group has to find and (mis)type the password :)

lucb1e 8y ago

> Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" No, no, no. The rest of your comment is spot-on, but I've done projects on passphrases and everyone gets this backwards. That is not what XKCD says. Let me quote the XKCD: > four random common words Random words, not a phrase like "may the force be with" and "my friend mark" (I'm sure you can find those two online). When cracking public hash dumps using phrases from public sources, I get hundreds of thousands of hits. If your phrase (partially) exists online, it's not a secret one. Someone else mentioned diceware. Six random words from that dictionary (potentially generated using real dice) is pretty much unbreakable, though it has only a small security margin for when a protocol gets weakened but not broken.

dogma1138 8y ago
These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most common English words, if leetspeak substitution is used you can also easily mask it. We did this experiment and even randomly generating 6 word passwords using Wikipedia as dictionary resulted in passwords which are faster to crack than 16 character randomly generated passwords and that is because you can’t count the entropy as single characters sure if you brute force it char by char it will take longer but if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.
- lucb1e 8y ago
  > These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. There is no fundamental difference. Either your pool of elements consists of 95 different symbols (ASCII printable characters and space) and you get passwords like 'F~iV3Bcv>\Q@' or your pool of elements consists of thousands of words and you get passwords like 'hubs exempted contend catchment others'. As per Kerckhoff's principle, we should assume that the method of generating the password is known (which set of elements, i.e. your charset or dictionary, which RNG was used, and perhaps the length of the password). The resulting strength in terms of bruteforceability of its hash is equal. Assuming one picks sane values, e.g. 6 elements when using a 7800 element set, or 12 elements when using a 95 element set, both are safe to use. > randomly generating 6 word passwords using Wikipedia as dictionary I don't understand what you mean by "using Wikipedia as dictionary". Wikipedia contains whole sentences. Did you download a dump of the English Wikipedia and split it on non-word characters and use that as dictionary? Did you remove duplicate words? Or did you take Wiktionary's words? > if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. I think you're wrong, but feel free to prove me wrong :). Here are some hashes: f4cd51713a3ac5798b3a0b40fe61aa2f f424f3432b7acbce2c2d3548490c9cc0 71fa597116bfc54ecc6c48162629d391 beb09edbc493bf826b61afa6905712df 42251a29996a78ef023bdb03a8c22ea9 3a80f15bd82c4f4c0a3338a1fa86adb9 They were generated using this script: function genphrase { x=$1; while [ $x -gt 0 ]; do echo -n $(shuf /usr/share/dict/words | grep -v é | grep -v \' | tail -1)\ ; let x=$x-1; done; } for i in {1..6}; do phrase="$(genphrase $i)"; sum=$(echo -n "$phrase" | md5sum | awk '{print $1}'); echo "$sum $phrase"; done; Basically I take random words from /usr/share/dict/words so long as it does not contain an apostrophe or an accented e. The md5 hash of the result is generated, a very fast and well-supported algorithm (your favorite cracking program should support it without any trouble). As an example, from another run of the script, here is one of its output lines: 75e6881687661e09e404b517e7ee2ce3 goodliest villeins gymnast You can use this sample output to verify that the hash is generated correctly and that your tool works. I expect the first two hashes should not be an issue, the third might be harder, the fourth would be impressive, and I expect that the fifth and sixth will remain uncracked. The dictionary version is 2018.04.16-1 (wamerican package in Debian), I uploaded it here: https://lucb1e.com/tmp/words https://lucb1e.com/tmp/words (watch out clicking the link, it's a large file and your browser may just display it instead of downloading it) > You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine. At least in my research, I've found that markov chains and n-grams are of much worse quality and slower than just using raw phrases from public sources. The downloading and processing of those sources takes more time, but that's a one-time action and not really part of the cracking process. And as I said in the comment you're replying to, if your 'phrase' is not random words but actually a logical 'phrase', then it's not suitable as passphrase. I think you're confusing random phrases with logical sentences.