10 ms·
Toddler Password – Get a secure password generated by a toddler
- ghostly_s 7y agoI don't know what they're doing with the site design but it's completely devoid of text for me even with my adblocker turned off. I thought that was part of the gimmick at first until I realized there is text displayed for a fraction of a second before it finishes loading.
- tokstesla 7y agoNice idea. But most times, the passwords can be difficult to memorize.
- WilliamEdward 7y agofriendly advice - you should be using a password manager, not memorising passwords :) longer passwords are better
- thomaspark 7y agoWell done on the site, lovely style and funny idea.
- brianberns 7y agoThis is cute, but I'm dubious. It generated "y3aEmic8B217" as my password. Kid just happened to hit the shift key while also pressing E and then B? It looks a little too random to me. When I pound on the keyboard, I get results that look more like "fjlsd;lasf".
- jefftk 7y agoMy guess is they're using what the toddler typed to seed an RNG?
- brianberns 7y agoYeah, the verbiage says that his typing is merely the "basis" for the resulting password, so you're probably right.
- robbya 7y agoWhich means the password has much less entropy than it appears to have. It's a fun implementation, but not serious
- tialaramex 7y agoSo, kinda, sorta, mostly no. We have these things called stream ciphers. You put a little bit of randomness in, and you get what seems to be lots of randomness out. For example the cipher might need a 256-bit key and 128-bit nonce and then spit out gigabytes of seemingly random data. Now, mathematically they can't /really/ be making more randomness, there's no random steps it's all deterministic, in principle it ought to be possible to unwind the steps and get back the initial random state. But it turns out that unwinding step just can't actually be done with a good stream cipher, that's the whole point. We do this sort of stuff a lot in real modern cryptography. There's a HN article which might still be on the front page, it was earlier today, explaining how SSH works. It shows that six keys are needed for SSH encryption, but they don't go get six times the randomness you'd need for a single key, they can just use a cryptographically strong hash function and make six different keys from the same shared secret randomness. Let's do an experiment: I've rolled my hex dice a few times to create a 64-bit random number. I've pushed that as ASCII text into MD5 and got back a result, and now I'm going to tell you the first and last characters of the result: F31FB042................81AFD8FA That's 64-bits. If you were correct with this idea about entropy you could tell me what the missing bits are, infact you could prove it to other posters - after all I have given you all the randomness according to your thinking, there can't be any left. But in fact you have no idea what those missing bits are, no idea what the original 64-bit number was, because you are wrong, with cryptographic primitives like hashes or stream ciphers we can in practice take a relatively small amount of entropy (like a few minutes of keyboard bashing by a toddler) and that's enough for all purposes. The _real_ reason you shouldn't use this to make passwords is that the site might be lying and keeping a record of every password that is chosen and which IP address it was given to etcetera.
- phasetransition 7y agoMy 2 year old would like to join as technical employee #1, but only if he gets forward vesting.
- trothamel 7y agoAh, the NSA. Those scamps.
- blotter_paper 7y agoPoor Max -- his dad's a developer, but he still has to work as a typist just to afford clean diapers, food, and toys. Everybody donate to this poor child's cause! Joking aside, will I break this if I request too many characters? Does it loop after running out of Max's prior input? Is Max really just a script?
- WilliamEdward 7y agoNo i requested a 50 char length password and spammed the button and it kept giving me passwords. What's likely is the kid's input was used as a seed (string to int?) and then put into a random number generator. Kind of cute :)
- code-is-code 7y agoA human using a keyboard is one of the worst RNAs out there
- wyldfire 7y agoPretty entertaining. But if you want people to feel any more confident in your generator, you need to have entropy metrics. I have a feeling toddlers might be worse than other entropy sources.
- pesfandiar 7y agoThis is cute, but I'd rather use the very secure password generated by experts at https://mostsecure.pw/ https://mostsecure.pw/
- Consultant32452 7y agoHilarious, that site gives the same password every time I load the page. Also, that password has never been hacked according to haveibeenpwned.
- Selfcommit 7y agoYes, I think that's the joke :)
- deleted 7y ago[deleted]
- goldenkey 7y agoIs the name because only a toddler would use a password not generated on their own rig?
- br1anberg 7y agoi still really like dinopass.com
- Steve0 7y agoI tend to type guid in duckduckgo. https://duckduckgo.com/?q=Guid https://duckduckgo.com/?q=Guid Bad idea?
- gruez 7y agowhy not just use uuid(1)?
- jolux 7y agoyou can also just type password and it'll generate a password
- ChrisGranger 7y agoYou can also specify length and strength of the generated password: password 20 high password 10 low
- Dylan16807 7y agoThough there's barely any difference in strength. It looks like it has upper and lower case for 'low', and 'high' adds numbers and the 10 symbols on the number keys. That's 5.7 bits per character vs. 6.2 bits per character. The 'high' strength passwords are only 8% stronger.
- mxcrossb 7y agoYou can actually just do this on any website. When making an account, just type password into the password field. The best part is you can do the exact same thing at login, so you never have to memorize the super secure password they generate.
- ChrisGranger 7y agoYou jest, but it seems an awful lot of people actually do do this...
- poglet 7y ago
- entelechy0 7y agoChild slavery, awesome!
- lukevers 7y agoThis is great. My daughter does this for me too: https://twitter.com/lukevers_/status/1181217729216425984 https://twitter.com/lukevers_/status/1181217729216425984 https://twitter.com/lukevers_/status/1181217968287559680 https://twitter.com/lukevers_/status/1181217968287559680
- trpc 7y agoAfter decades of academic research, true randomness finally achieved.
- peteretep 7y ago> A toddler acts with good faith Questionable
- NetOpWibby 7y agoAs a parent of a threenager, In inclined to agree.
- em-bee 7y agoteenagers and toddlers are quite different. i can assure you that despite outside appearances, when your teenagers were toddlers they were acting in good faith, until they learned otherwise, from you.
- topkai22 7y agoMy toddler provides a whole security suite- she will set your critical files to readonly (by pulling all the keys of your keyboard), airgap your network (by playing with the power strip its connected to), and virus detection (by beginning to emit screams and snot as soon as she catches one) :)
- 33Backpack33 7y agoReport for child labor!
- johnramsden 7y agoChild labor, contacting Social Services.
- lostgame 7y agoMy very first thought - I can’t decide if I’m just being way too sensitive or if this is actually as wildly inappropriate as it seems.
- bdcravens 7y agoWon't the service have reduced entropy as time goes on? In 2034, all the passwords will be "lol duh"
- K0SM0S 7y agoJust to point out that human "smashing keyboard" is far from random. Even if it weren't due to the keyboard's fixed layout (between two smashes), it's largely because of our non-random nature — a human being cannot reliably output random objects even in thought / speech. Don't ask me why (I don't think anyone knows or could prove it theoretically) but it's been verified countless times (war secrets help make such research important). We're at best capable of pseudo-randomness mathematically. Some controversial neuroscience even places us far into the deterministic scope. A child is probably way more determined than an adult for that matter, due to a much simpler schema of reality, with 'weird obsessions' (e.g. it feels nice to smash the same place over and over again, our brain is quick to play games like that, such as walking on specific tiles to avoid the lava in the street). I wouldn't trust most animals to output randomness. We have crypto packages suited for that purpose. ;-)
- ignoranceprior 7y agoFor anyone who wants an intuitive feel for how hard it is for humans to generate random bits, I would recommend playing this game: https://roadtolarissa.com/oracle/ https://roadtolarissa.com/oracle/
- pkolaczk 7y agoHuh, I got 48%. Am I more random than random? :D
- blotter_paper 7y agoFrom the page: > Knowing what the computer will guess, you can guarantee that it is always wrong by picking the other direction. Doing the opposite of what a computer tells you isn’t quite free will though!
- hcs 7y agoI think what's usually involved in seeding someyhing like this is the noise in timing, not the actual characters entered.
- nyolfen 7y agostill as vulnerable to a rubber ducky attack as ever
- aloknnikhil 7y agohttps://www.toddlerpassword.com/privacy https://www.toddlerpassword.com/privacy Why does this need analytics and thus tracking cookies? I'm genuinely asking. What kind of data does this even need tracking?
- 2pointsomone 7y agoSame concern
- ggggtez 7y agoThis is obviously not real.
- iandanforth 7y agoHere's the stock photo: https://www.gettyimages.com/detail/photo/cute-baby-boy-sitting-in-nature-with-laptop-royalty-free-image/174751793 https://www.gettyimages.com/detail/photo/cute-baby-boy-sitti...
- SquishyPanda23 7y agoA toddler is basically a human that just booted. I'm not sure they have enough entropy to generate a good password. :-P
- lostgame 7y agoWell, conversely they have very little bias, since they have no previous experience - which could be useful?
- em-bee 7y agothe entropy contained in a freshly generated human is a few million times more than that of any computer we can build today. the limitation is the speed at which the human can translate that entropy into machine readable data
- fortran77 7y agoThis is absolutely not secure. If he let the kid type away for an hour and is selecting sub-strings from it, then all the passwords generated from this exist in a file that can be ex filtrated given enough requests to his server.
- jlgaddis 7y agoWhat if he let the kid type away for an hour, hashed that with SHA512, and used that as a seed for an RNG? Gigabytes of perfectly usable key material could be generated!
- deleted 7y ago[deleted]
- Istribitel 7y agoFrom experience with my kids when they were toddlers, they would type what they saw. I was kind of freaked out when my son typed "WARNING". They watched VHS tapes or DVDs that began with that message.
- netsec_burn 7y agoThere is a reason why password generators are client side, not server side. The server can store all passwords it has ever provided.
- computerex 7y agoI am inclined to not trust the story here. Too many shady things going on. The passwords just seem like they are generated algorithmically so the whole underlying premise seems to be bs. The images can be found on a stock image site, they are asking for money and it's all done in a very shady way where the password is being generated serverside making it inherently insecure as a generator. Seems like someone is using the imagery of a cute child to make a few extra bucks, at best.
- Exuma 7y agoWhy is this upvoted so high, this is purely a scam, and the passwords are not generated in the client.
- c8g 7y agoI need a secure password, so, I am going to use a password that was generated in a secure server :) what a great idea :)
- anonu 7y agoSo, this is fun idea. I have a toddler, so I identify. She constantly mashes my laptop keyboard, often deleting large blocks of code or typing gibberish into slack. My biggest revelation here is how terrible the new MBP keyboard is. Just a bit of keyboard mashing and many keys are rendered useless. They require some gentle massaging to get back to a semi working state.
- cookingoils 7y agohmmm interesting... was this site based on this post from '17? https://artur.co/blog/07-30-17-preschooler-secure-password-technique https://artur.co/blog/07-30-17-preschooler-secure-password-t...