4 ms·

There are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of pas

by bartvk 3y ago

There are a number of such generators, but this one has good defaults (with the number at the end). IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/ https://xkpasswd.net/s/

thfuran 3y ago
Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.
- User23 3y ago
  Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.
  - thfuran 3y ago
    A password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.
    - User23 3y ago
      Sure, but I thought it was obvious you wouldn't use one word. I'm saying a six megabyte file plus a one line shell script is enough to generate secure passwords with just four words by producing something like "Gargantuan Lackadaisical Lugubrious Flibbertigibbet" which while a bit of a mouthful isn't terribly difficult to memorize compared to 76 bits of line noise or even base64.
      - thfuran 3y ago
        But that's not what was being discussed. Someone suggested that if one were to use a website that generates passwords, they should use one that generates multiple passwords to pick from to mitigate the risk of the site being malicious and knowing your password. And I'm saying that that is not useful for any practical length of password candidate list.
rcoveson 3y ago
There's no way people actually use random websites to generate their passwords, right? Like, I can't just post or comment a password generator to a reasonably-tech-savvy forum like HN and have people actually use it to generate their next email password, can I? Surely there's at least some communal wisdom about how to correctly obtain software that you can reasonably trust with such an important task?
- mcdonji 3y ago
  This is a fun project, and I respect implementing anything birthed from XKCD, but I agree and don't think I'd use this sort of thing to generate my passwords. ( Or I'll just stick to Password123 )

by bartvk 3y ago

thfuran 3y ago

Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.

User23 3y ago
Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.
- thfuran 3y ago
  A password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.
  - User23 3y ago
    Sure, but I thought it was obvious you wouldn't use one word. I'm saying a six megabyte file plus a one line shell script is enough to generate secure passwords with just four words by producing something like "Gargantuan Lackadaisical Lugubrious Flibbertigibbet" which while a bit of a mouthful isn't terribly difficult to memorize compared to 76 bits of line noise or even base64.
    - thfuran 3y ago
      But that's not what was being discussed. Someone suggested that if one were to use a website that generates passwords, they should use one that generates multiple passwords to pick from to mitigate the risk of the site being malicious and knowing your password. And I'm saying that that is not useful for any practical length of password candidate list.

rcoveson 3y ago

There's no way people actually use random websites to generate their passwords, right? Like, I can't just post or comment a password generator to a reasonably-tech-savvy forum like HN and have people actually use it to generate their next email password, can I? Surely there's at least some communal wisdom about how to correctly obtain software that you can reasonably trust with such an important task?

mcdonji 3y ago
This is a fun project, and I respect implementing anything birthed from XKCD, but I agree and don't think I'd use this sort of thing to generate my passwords. ( Or I'll just stick to Password123 )