7 ms·
Correct Horse Battery Staple: Secure Password Generator
- jkingsman 3y agoIt's a cute idea and I love the concept from XKCD, but the best practice is just to use a password manager and stop trying to remember passwords (and absolutely never reusing passwords).
- strulovich 3y agoBut: - you need a password for your password manager - you also need a password for your actual desktop/phone, when the manager is inaccessible. - you may have a work computer requiring a different password as well Here are already 3, ideally different, passwords you need to remember.
- JohnFen 3y agoI only have to remember one password: to my password manager. My phone uses a different unlock method entirely, and my work computer's password is stored in my password manager. Although after a couple of days of using a new password regularly, I can't help but have it memorized anyhow.
- deleted 3y ago[deleted]
- Maxburn 3y agoMost humans create terrible passwords (myself included) and I really benefit from simply having a random word generator. I use generators like these to create a random word cloud to pick and chose from to create my actual password. I also might have to read particular passwords over the phone to someone in a rare emergency so real words help with that a lot. This particular one doesn't throw enough random symbols in between words IMO, I also like to throw in misspellings and random caps which none of them seem to do.
- JohnFen 3y agoYes, I use a random password generator for all of my passwords. But I don't use the XKCD method because I actually find that style of password more difficult to remember and more of a pain to type in.
- Maxburn 3y agoSee also (mostly for fun / ideas); http://www.manly-man.net/ http://www.manly-man.net/
- tikkun 3y agoWould be neat if it had stable diffusion powered image generation, to help people visualize and remember their passwords.
- shadowgovt 3y agoMemory's a real issue. In principle this is a nice demo; in practice I will be able to retain like five to seven of these high-entropy blobs before they all run together. The fundamental problem with passwords is still the need for them.
- forgetfulness 3y agoYou only really need three passwords, four at most; for your own computer, your own email, your password manager, probably your work computer. Have a passphrase for each and let the password manager generate noise for everything else.
- stonemetal12 3y agoThis could really use a entropy measure for the options you pick. Also what is the default dictionary? If it is diceware, then the site's default 4 words hasn't been considered secure for a while. There is an Ars Technica article from 2014 that says 6 should be the minimum. I bet it is higher now.
- personjerry 3y agoBut having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14
- rcoveson 3y agoIt's a password generator hosted on a domain with zero reputation. Insufficient entopy is nowhere near as concerning as the software distribution mechanism. Audit the code? Maybe it's different tomorrow. Maybe it's different based on client fingerprint! Internet explorer users in retirement communities get the version with a known, fixed random number seed.
- Symbiote 3y ago)=*vZqV Grateful-Afternoon-Resistance-South-0 The second is much easier to remember, and common security measures need to be practical. Incidentally, I have two small shell functions to generate these. Tweaked slightly: < /dev/urandom tr -dc '!-~' | head -c${1:-7}; echo for i in `seq 5`; do echo -n `grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | shuf -n 1` echo -n ' ' done
- fanf2 3y agoYou should not have to remember more than 2 or 3 passwords, enough to log in to your main computers and password managers. If you have few enough passwords that you use frequently enough, they can be completely random, and there is no need to get creative with “memorable” generation schemes.
- throw0101c 3y agoDiceware recommended going to six words back in 2014: * https://arstechnica.com/information-technology/2014/03/diceware-passwords-now-need-six-random-words-to-thwart-hackers/ https://arstechnica.com/information-technology/2014/03/dicew... They have 7,776 words in their list; that gives 77.5 bits. * https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
- LastMuel 3y ago
- bartvk 3y agoThere are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/ https://xkpasswd.net/s/
- thfuran 3y agoUnless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.
- User23 3y agoWhy? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.
- thfuran 3y agoA password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.
- User23 3y agoSure, but I thought it was obvious you wouldn't use one word. I'm saying a six megabyte file plus a one line shell script is enough to generate secure passwords with just four words by producing something like "Gargantuan Lackadaisical Lugubrious Flibbertigibbet" which while a bit of a mouthful isn't terribly difficult to memorize compared to 76 bits of line noise or even base64.
- thfuran 3y agoBut that's not what was being discussed. Someone suggested that if one were to use a website that generates passwords, they should use one that generates multiple passwords to pick from to mitigate the risk of the site being malicious and knowing your password. And I'm saying that that is not useful for any practical length of password candidate list.
- rootusrootus 3y agoAt this point, average users are better off with a password manager and/or passkeys. The fraction of users willing to learn more than one decent password and not use it in multiple places is probably 1% or less.
- etrautmann 3y agoYes, but this is a great way to create a master password for your manager
- rootusrootus 3y agoI generally agree. I've used an XKCD-style password for a long time for my 1Password master password. But it does have downsides -- on a mobile device, it's a lot of typing, if you need to enter it.
- shadowgovt 3y ago"Correct horse battery staple?! That's amazing. I've got the same password on my luggage."
- throw0101c 3y agoSee also Diceware: * https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware * https://diceware.rempe.us/ https://diceware.rempe.us/
- sparcpile 3y agoThis is nice. I previously wrote up a KornShell script that did that with the 3000 most common English words, added the dashes, and two digit numbers to make up a suitable password for my password manager and places where I could not use a password manager. I also used dashes as a word separator and to count as a special character. Nearly everyone allows for - , but it is hit or miss for other special characters.
- tomxor 3y agoPromoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your package manager, e.g: sudo apt install diceware diceware -n 6 QuickenPrisonThermosDefilingBasicsVengeful
- renewiltord 3y agoOr could just do something like this: cat /usr/share/dict/words | shuf | head -n 4
- dragontamer 3y agoDiceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist (https://theworld.com/~reinhold/diceware.wordlist.asc https://theworld.com/~reinhold/diceware.wordlist.asc) is something that can be accomplished by hand, without computer assistance. Assuming you have trustworthy dice (they don't have to be perfectly balanced, just something you can trust to be random), then you can diceware your own password by hand.
- adzm 3y agoWell, you only need one six-sided die really. It's really fun to do as well. I highly recommend the EFF wordlist though.
- Imnimo 3y agoI feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.
- keybored 3y agoEEF’s is better. https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
- hn_throwaway_99 3y agoThis goes against the whole idea of that XKCD comic. If you want to come up with a password you can remember, you should string together a bunch of words that make sense to you. But if you want a password you can remember, randomly generating it (especially in a way that has low overall entropy per the current top comment) seems like a bad way to do it. IMO the days of remembering multiple passwords are gone - either use a password manager, or thankfully the industry is moving to passkeys.
- macrael 3y agoThe XKCD comic was absolutely about randomly generating a four word password, not picking four words that mean something to you. That's how the math works is if each word is random.
- hprotagonist 3y agoi’ve used https://diceware.rempe.us/#eff https://diceware.rempe.us/#eff fairy happily over the years
- sfvisser 3y agoAnd save every generated password for later use. Nice Reminds me of the online bitcoin wallet public key QR code generator that just generated a code for some attacker’s wallet and got themselves some free coins.
- mNovak 3y agoFor those wondering, the source including word list is linked [1]. At a glance, the base dictionary is 2280 words; jargon is 8800; science is 575. So, definitely consider adding all the lists! That gives (check my math) ~13.5 bits entropy per word. [1] https://bitbucket.org/jvdl/correcthorsebatterystaple/src/master/data/ https://bitbucket.org/jvdl/correcthorsebatterystaple/src/mas...
- abdusco 3y agoBitwarden also supports this out-of-the-box https://bitwarden.com/help/generator/#password-types https://bitwarden.com/help/generator/#password-types see "Passphrase"
- _kst_ 3y agoLike many others, I've written my own correct-horse-battery-staple-based passphrase generator. "gen-password" generates random passwords, allowing your to specify length and character set. "gen-passphrase" generates correct-horse-battery-staple-style passphrases. Both are written in Perl, using /dev/urandom by default for randomness. https://github.com/Keith-S-Thompson/random-passwords https://github.com/Keith-S-Thompson/random-passwords
- AviationAtom 3y agoIt's been noted elsewhere in the comments, but I think it's worth pointing out that 1Password incorporates a similar algorithm for random password generation. It allows you to configure a series of uppercase words, lowercase words, special characters, and numbers. i.e. CAR-horse7ambulance