7 ms·
Not really, it's a great way to make passwords. Chose a nonsense phrase from some popucluture thing or whatever, and add in or replace some letters with number
by Zurrrrr 4y ago
Not really, it's a great way to make passwords.
Chose a nonsense phrase from some popucluture thing or whatever, and add in or replace some letters with numbers and symbols.
Something like kRyptoni4n!muGgl342r0nin is easy to remember, and not being brute forced anytime soon.
- kristopolous 4y agoEver run a dictionary cracker like hashcat? You really really should, with modern GPU hardware. Read the documentation too. Your example is a pretty early match. letter/number cycling, single case substitutions, symbol concatenation - GPUs can cycle through those in parallel, fast. It's a guessable password + guessable ruleset. You've introduced far less entropy than you've imagined. If you want to have protection against attacks and use your technique, you have to come up with a ruleset you (1) don't see in the documentation (2) that's computationally unreasonable. For instance, combine multiple languages. Strawberry Octopus Sundae, which is pretty memorable, can become FragolaOctopusEisbecher combining Italian, English and German. And with that we just went O(N^3) where N is dictionary size (actually more than that because you've got a wide choice of latin scripted language). That gives you far more protection then say sTr4b33ry+0ct0pu5!5und43. You aren't fooling a GeForce RTX 4090 with those tricks. That's an example I just came up with though. There's lots of things like that. But really run a cracker. Try it out.
- Zurrrrr 4y agoThe example I gave isn't that guessable. It's combining things from different popculture into one new phrase that won't be in any dictionary. An even better attempt is to insert a whole word between two sides of a broken up word, e.g. `4mAzonij-0rdan4Npr7nces7`. And yes I use hashcat frequently. Using something like a 20 character password following that formula is going to be fine for most people - it isn't going to be brute forced before someone gets an alert that passwords are compromised and can change it. It's a much better solution IMO than using something entirely random and writing it down, or using something like LastPass.
- kristopolous 4y agoReally? Pop culture wordlists are insanely common and small - sometimes they're run Before general ones because they're fast to go through and have so many hits. This response isn't for you par se, I just don't want people to go off and think they're protected with beyonceMadonna because they read it on hacker news. Put your needles in the biggest haystacks you can find, not the rarefied air of celebrities. Also don't think you're protected with "old" names like GreenDayEminem. Using older celebrity lists to preference forgotten or abandoned accounts is another common technique. Sometimes you're just a stepping stone and not the target. Find a bigger crowd to get lost in. For instance, say an address + phone number of a place you remember that's not yours. 419FSt#201 is an old friend and 8184093100 is a friend I had in childhood. Those are two big crowds. Phone numbers have way more structure than you probably think but it's still a fairly big haystack.
- Zurrrrr 4y ago> Really? Pop culture wordlists are insanely common and small - sometimes they're run BEFORE the general ones because they're so fast to go through and have so many hits. That's the thing though, I'm talking about combining pop culture words in a way that they are not in any list. beyonceMadonna is quite a bit different from `b3Y0nm-Ad0nn\ac3` That's using two words from pop culture, merged together with numerous substitutions. It's easy to generate, easy to remember, and won't be in any lists, and shouldn't be bruteforced (well, I'd increase it to at least 20 from 16) in the time a breach is reported and a reasonable window for changing a password after being notified. I do agree with everything you've said though.
- loloquwowndueo 4y agoPretty sure fragola is Italian, not French. Entirely sure it’s not French for strawberry (fraise).
- kristopolous 4y agoYou're right. Corrected
- FrontierPsych 4y agoI have finally just started using completely and totally random upper/lowercase letters, numbers and special characters. No rhyme or reason. Usually 15 characters or more. That's ok, isn't it?
- kristopolous 4y agoMachine generated? yes. Human generated? no.
- FrontierPsych 4y agoHow in heck can a computer guess 15 human generated password? Can it guess a 58 character password that is human generated?
- Aachen 4y agoNote the part where the example says "squash:club", not "n!mGgl342r0nin" Password guessing and cracking is part of my job. GP is right: the advice is absolutely terrible. Your example looks good but the secret sauce is the way by which you create it. Maybe it's just leetspeak for something a million fans know, in which case it would be in my dictionary by virtue of downloading Wikipedia and other cracked password lists and the leetspeakify rules will find it in a matter of hours or days for a typical leaked hash (this looks like a domain admin password we might find on a workstation they logged into). Eyeballing mGgl3etc., it doesn't look like something you'd find in anyone else's password, which makes it unpredictable, which makes my job hard and your account safe. But you can't determine a password's strength from the generator's output (only if it's terrible) so idk.
- jmholla 4y agoHow do you usually direct people to generate passwords they'll need to remember?
- teddyh 4y agohttps://xkcd.com/936/ https://xkcd.com/936/
- joe_guy 4y agoThat's really good advice if you use the same password for everything. It becomes untenable with the, what, hundred+ websites I have a login for, each with their own password.
- teddyh 4y agoThen you need a password manager. OTOH, people in the old days used to memorize a lot of phone numbers, so remembering things is not as hard as you might think.
- deleted 4y ago[deleted]
- EVa5I7bHFq9mnYK 4y ago>> Something like kRyptoni4n!muGgl342r0nin is easy to remember Crying boomer here ... forgot where I put my tissue again.
- Zurrrrr 4y agoThat's why this technique is good though. Look at the 3 words I modified.. kryptonian, muggle and the last was '47 ronin'. Alternate case, make some substitutions for letters with numbers/symbols, add in additional numbers/symbols, and you'jj have something that isn't trivial to bruteforce. Once you know the core words you are using, you only have to memorize the substitutions you have made, which is much easier.
- ThePowerOfFuet 4y agohttps://xkcd.com/936/ https://xkcd.com/936/