3 ms·

as in 10^6 possibilities, ignoring backgrounds? For the curious, that means collisions are expected >50% of the time with ~1200 samples, and someone could easil

as in 10^6 possibilities, ignoring backgrounds? For the curious, that means collisions are expected >50% of the time with ~1200 samples, and someone could easily generate collisions on purpose with little effort. So it works well for a simple signal (which is the goal), but shouldn't be relied on if people might try to abuse it.

e1ven 15y ago
If you use all three sets (?set=any), plus backgrounds, that adds two additional choices, which brings us into the 100+ Million category. As a signal to review the Pubkey, that's probably enough. I could have made up more Random elements, but that'd take more time/money, which isn't worth it unless anyone outside of me actually wants it ;)
- pavel_lishin 15y ago
  Sounds like it would be a pretty good "did I type my password correctly?" indicator.
  - whatusername 15y ago
    Lotus Notes has one of those with a set of keys. I recall that the first couple of times it was weird -- then it seemed to make sense. What is really weird though -- it puts in additional XX characters when you typed out your password. So type out "pass" and it might display "XXXXXXX" Which I guess is effective for preventing over-the-shoulder information leakage but weird all the same.
  - mgkimsal 15y ago
    woudn't you need to be sending the password over to the robot icon people to get the imag?
  - k33l0r 15y ago
    You might be interested in Chroma Hash for that sort of purpose: http://mattt.github.com/Chroma-Hash/ http://mattt.github.com/Chroma-Hash/
- oconnore 15y ago
  It seems like it would give you a false sense of security. You have to think about it in terms of "could an attacker who can spend $1000/hr brute force a duplicate pub/priv key combination that generates the same robot. I wonder if you could get better results using a markov chain to generate english prose from a large sample. If you take the top N next word options, and select one based on the next log_2(N) bits of your hash/key, you lose no key space and should get a nonsensical but perhaps easily remembered string.

e1ven 15y ago

If you use all three sets (?set=any), plus backgrounds, that adds two additional choices, which brings us into the 100+ Million category. As a signal to review the Pubkey, that's probably enough. I could have made up more Random elements, but that'd take more time/money, which isn't worth it unless anyone outside of me actually wants it ;)

pavel_lishin 15y ago
Sounds like it would be a pretty good "did I type my password correctly?" indicator.
- whatusername 15y ago
  Lotus Notes has one of those with a set of keys. I recall that the first couple of times it was weird -- then it seemed to make sense. What is really weird though -- it puts in additional XX characters when you typed out your password. So type out "pass" and it might display "XXXXXXX" Which I guess is effective for preventing over-the-shoulder information leakage but weird all the same.
- mgkimsal 15y ago
  woudn't you need to be sending the password over to the robot icon people to get the imag?
- k33l0r 15y ago
  You might be interested in Chroma Hash for that sort of purpose: http://mattt.github.com/Chroma-Hash/ http://mattt.github.com/Chroma-Hash/
oconnore 15y ago
It seems like it would give you a false sense of security. You have to think about it in terms of "could an attacker who can spend $1000/hr brute force a duplicate pub/priv key combination that generates the same robot. I wonder if you could get better results using a markov chain to generate english prose from a large sample. If you take the top N next word options, and select one based on the next log_2(N) bits of your hash/key, you lose no key space and should get a nonsensical but perhaps easily remembered string.