5 ms·

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fightin

by jerf 7y ago

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Zaphod Beeblebrox wears 3 hats. He gives 1 to Ford. Why did he do that? He only has 2 heads. Xavier can't read Zaphod's mind now. (Does he even want to?) ZBw3hHg1tFWdhdt?Hoh2hXcrZmn(Dhewt?) That's 35. I could have that mostly memorized in a day's relatively normal usage, and definitely have it by a week. I have some rules I apply, like numbers -> their digits, periods are "free" but the other punctuation goes in, etc. Doesn't much matter what your rules are, as long as you're consistent. Technically, this is less random that a truly random password, because rather than drawing uniformly from the space of possible symbols, you're tilted in the direction of what words can start with and some other things like that. I tend to just make up for that by swinging more entropy at the problem, and trying to work in some Xs and Zs and unusual symbols, and figure that it gets me close enough. One trick to this: If you find in the first day that you're consistently remembering the phrase differently than you first laid it out, just take the hint and change the password.

Insanity 7y ago
How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?
- nwallin 7y ago
  I do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does. I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.
- jerf 7y ago
  I don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20. It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain. But if passphrases work better for you, by all means, please do. Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.
cameronh90 7y ago
That technique works if you're good at remembering long phrases/stories/quotes verbatim. Not everyone has a memory works that way. I've tried mind palace style and mnemonic techniques, and I will always remember the general gist, but typically not the exact order and specific words used. Same issue with reciting quotes. I can just about remember the 7 word phrase that I use to unlock my password manager, and I still sometimes mess it up. Similarly I can never remember the plot of films more than a few days after I watch them - though one great thing about that is you can always re-watch films like they're new. Yet simultaneously, I maintain a working memory of several programming languages/frameworks, and otherwise generally have a good semantic memory.
akira2501 7y ago
To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.
- Dylan16807 7y ago
  There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeric characters. It's unimaginably weaker than 32 random characters. A random word is generally worth about 2 to 2.5 random characters. Sometimes that's easier to remember, sometimes it isn't. And your example passwords are not that strong. A simple algorithm picking words just by rarity could hit "The coffee here is gross." within about 2^50 iterations, and a single consumer GPU can test about 2^48 - 2^52 hashes per day. "the", "here", and "is" are way too common. You only have two moderately random words.
  - ativzzz 7y ago
    I like to also purposefully misspell words, or use some kind of alternative representation of letters, like use 'keeb0rd' instead of 'keyboard'.
    - mtzet 7y ago
      Such common variations are accounted for by dictionary attackers.
      - ativzzz 7y ago
        Realistically, which of my passwords are accessible by such? The vast majority of my passwords are on the web. I don't think any web server is capable of receiving that many password requests to brute force the creds there. Otherwise to get access to my PC? Let's just say that if that ever happens, having a more randomized password (and one that I can actually use) that takes a bit longer to crack won't make much of a difference, considering they already have my PC.

by jerf 7y ago

Insanity 7y ago

How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?

nwallin 7y ago
I do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does. I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.
jerf 7y ago
I don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20. It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain. But if passphrases work better for you, by all means, please do. Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.

cameronh90 7y ago

That technique works if you're good at remembering long phrases/stories/quotes verbatim. Not everyone has a memory works that way. I've tried mind palace style and mnemonic techniques, and I will always remember the general gist, but typically not the exact order and specific words used. Same issue with reciting quotes. I can just about remember the 7 word phrase that I use to unlock my password manager, and I still sometimes mess it up. Similarly I can never remember the plot of films more than a few days after I watch them - though one great thing about that is you can always re-watch films like they're new. Yet simultaneously, I maintain a working memory of several programming languages/frameworks, and otherwise generally have a good semantic memory.

akira2501 7y ago

To me, there's an irony in that "Zaphod Beeblebrox's kite harasses Tuscon." is not only _more_ memorable on it's own, but is probably a _better_ password than "ZBw3hHg1tFWdhdt?Hoh2hXcrZmn" Stop using passwords, just use a "pass sentence." My last few passwords at my previous employer: "Tim, bring me chicken #15" "Mary, stop looking at me!" "Nothing you can do about 2!" "The coffee here is gross." Seriously.

Dylan16807 7y ago
There's absolutely no way a five word password is better than 32 random characters. Two plain old random words, the entropy of that is less than 16 bits each, but we'll round up. One of the biggest cities in the US is probably even less useful, but let's credit it for 16 bits. And let's rate Zaphod Beeblebrox as one-in-a-million for entropy purposes. That's 68 bits. It's somewhere between 11 and 12 random alphanumeric characters. It's unimaginably weaker than 32 random characters. A random word is generally worth about 2 to 2.5 random characters. Sometimes that's easier to remember, sometimes it isn't. And your example passwords are not that strong. A simple algorithm picking words just by rarity could hit "The coffee here is gross." within about 2^50 iterations, and a single consumer GPU can test about 2^48 - 2^52 hashes per day. "the", "here", and "is" are way too common. You only have two moderately random words.
- ativzzz 7y ago
  I like to also purposefully misspell words, or use some kind of alternative representation of letters, like use 'keeb0rd' instead of 'keyboard'.
  - mtzet 7y ago
    Such common variations are accounted for by dictionary attackers.
    - ativzzz 7y ago
      Realistically, which of my passwords are accessible by such? The vast majority of my passwords are on the web. I don't think any web server is capable of receiving that many password requests to brute force the creds there. Otherwise to get access to my PC? Let's just say that if that ever happens, having a more randomized password (and one that I can actually use) that takes a bit longer to crack won't make much of a difference, considering they already have my PC.