3 ms·

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of l

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

rcoveson 3y ago
It's a password generator hosted on a domain with zero reputation. Insufficient entopy is nowhere near as concerning as the software distribution mechanism. Audit the code? Maybe it's different tomorrow. Maybe it's different based on client fingerprint! Internet explorer users in retirement communities get the version with a known, fixed random number seed.
Symbiote 3y ago
)=*vZqV Grateful-Afternoon-Resistance-South-0 The second is much easier to remember, and common security measures need to be practical. Incidentally, I have two small shell functions to generate these. Tweaked slightly: < /dev/urandom tr -dc '!-~' | head -c${1:-7}; echo for i in `seq 5`; do echo -n `grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | shuf -n 1` echo -n ' ' done
- fanf2 3y ago
  You should not have to remember more than 2 or 3 passwords, enough to log in to your main computers and password managers. If you have few enough passwords that you use frequently enough, they can be completely random, and there is no need to get creative with “memorable” generation schemes.
throw0101c 3y ago
Diceware recommended going to six words back in 2014: * https://arstechnica.com/information-technology/2014/03/diceware-passwords-now-need-six-random-words-to-thwart-hackers/ https://arstechnica.com/information-technology/2014/03/dicew... They have 7,776 words in their list; that gives 77.5 bits. * https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware
LastMuel 3y ago
I had a idea similar to this, where you would misspell one or two words randomly - and then generate a sentence below the password to help with remembering the built-in obfuscation. Such as the Generate Password would be listed as: > Correct Horce Battery Staple > "Correct Horse-with-a-C Battery Staple"
- personjerry 3y ago
  Why not just use "Correct Horse-with-a-C Battery Staple" as your password then?
  - i2cmaster 3y ago
    Adding grammar will make it more predictable and less secure for the same word count.
    - wiml 3y ago
      It doesn't reduce the entropy any, so I don't see how it could be less secure (assuming you don't count "with a C" as the additional words, which obviously you wouldn't).
  - LastMuel 3y ago
    My thought was that it would add some protection against a dictionary attack. "Horse-with-a-C" is a longer password, but could possibly be hit using an algorithm that expects "with-a-[letter]" to be generated as part of a password. The randomized misspelling of a word-or-two was intended to break a dictionary attack.
- keybored 3y ago
  What’s the point? Obfuscation doesn’t increase entropy.
  - LastMuel 3y ago
    The obfuscation is to break a dictionary attack.
charukiewicz 3y ago
The default settings append a number at the end, so that's 2.7e+14. Moreover, there's a separator character that may or may not be there, and may or may not be changed from the default. Furthermore, I don't know why the "jargon" list isn't included by default, which adds 8,800 relatively common words (e.g. born, advice, engine, perspective). So with the digit at the end and all other default settings, that's 11000^4*10 = 1.46e+17.
ezfe 3y ago
1Password uses a Word List [1] of 18k words: 1.09e+17 which is more than an 8 character password from 100 usable characters.

But having a wordlist of ~2281 words means the search space is 2281^4 = 2.7e+13 which is less than an ascii password (roughly 100 usable ascii characters?) of length 7 i.e. 100^7 = 1e+14

rcoveson 3y ago

It's a password generator hosted on a domain with zero reputation. Insufficient entopy is nowhere near as concerning as the software distribution mechanism. Audit the code? Maybe it's different tomorrow. Maybe it's different based on client fingerprint! Internet explorer users in retirement communities get the version with a known, fixed random number seed.

Symbiote 3y ago

)=*vZqV Grateful-Afternoon-Resistance-South-0 The second is much easier to remember, and common security measures need to be practical. Incidentally, I have two small shell functions to generate these. Tweaked slightly: < /dev/urandom tr -dc '!-~' | head -c${1:-7}; echo for i in `seq 5`; do echo -n `grep --perl-regexp '^[a-z]{4,7}$' /usr/share/dict/words | shuf -n 1` echo -n ' ' done

fanf2 3y ago
You should not have to remember more than 2 or 3 passwords, enough to log in to your main computers and password managers. If you have few enough passwords that you use frequently enough, they can be completely random, and there is no need to get creative with “memorable” generation schemes.

throw0101c 3y ago

Diceware recommended going to six words back in 2014: * https://arstechnica.com/information-technology/2014/03/diceware-passwords-now-need-six-random-words-to-thwart-hackers/ https://arstechnica.com/information-technology/2014/03/dicew... They have 7,776 words in their list; that gives 77.5 bits. * https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware

LastMuel 3y ago

I had a idea similar to this, where you would misspell one or two words randomly - and then generate a sentence below the password to help with remembering the built-in obfuscation. Such as the Generate Password would be listed as: > Correct Horce Battery Staple > "Correct Horse-with-a-C Battery Staple"

personjerry 3y ago
Why not just use "Correct Horse-with-a-C Battery Staple" as your password then?
- i2cmaster 3y ago
  Adding grammar will make it more predictable and less secure for the same word count.
  - wiml 3y ago
    It doesn't reduce the entropy any, so I don't see how it could be less secure (assuming you don't count "with a C" as the additional words, which obviously you wouldn't).
- LastMuel 3y ago
  My thought was that it would add some protection against a dictionary attack. "Horse-with-a-C" is a longer password, but could possibly be hit using an algorithm that expects "with-a-[letter]" to be generated as part of a password. The randomized misspelling of a word-or-two was intended to break a dictionary attack.
keybored 3y ago
What’s the point? Obfuscation doesn’t increase entropy.
- LastMuel 3y ago
  The obfuscation is to break a dictionary attack.

charukiewicz 3y ago

The default settings append a number at the end, so that's 2.7e+14. Moreover, there's a separator character that may or may not be there, and may or may not be changed from the default. Furthermore, I don't know why the "jargon" list isn't included by default, which adds 8,800 relatively common words (e.g. born, advice, engine, perspective). So with the digit at the end and all other default settings, that's 11000^4*10 = 1.46e+17.

ezfe 3y ago

1Password uses a Word List [1] of 18k words: 1.09e+17 which is more than an 8 character password from 100 usable characters.