5 ms·
Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator. A local diceware generator is probably available in your pac
by tomxor 3y ago
Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator.
A local diceware generator is probably available in your package manager, e.g:
sudo apt install diceware
diceware -n 6
QuickenPrisonThermosDefilingBasicsVengeful
- renewiltord 3y agoOr could just do something like this: cat /usr/share/dict/words | shuf | head -n 4
- dragontamer 3y agoDiceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. For all of its faults, 5x six-sided dice looking up this wordlist (https://theworld.com/~reinhold/diceware.wordlist.asc https://theworld.com/~reinhold/diceware.wordlist.asc) is something that can be accomplished by hand, without computer assistance. Assuming you have trustworthy dice (they don't have to be perfectly balanced, just something you can trust to be random), then you can diceware your own password by hand.
- adzm 3y agoWell, you only need one six-sided die really. It's really fun to do as well. I highly recommend the EFF wordlist though.
- Imnimo 3y agoI feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.
- keybored 3y agoEEF’s is better. https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
- joecool1029 3y agohttps://pypi.org/project/xkcdpass/ https://pypi.org/project/xkcdpass/ this uses eff-long as the default (but also has other lists). It's available over pip and/or through most distro package managers.
- TJSomething 3y agoI don't like the original diceware list. The EFF made a pretty good list though: https://www.eff.org/dice https://www.eff.org/dice
- deleted 3y ago[deleted]
- tomxor 3y ago> The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself. I'm just a humble non-crytographic-programmer making practical suggestions with the most substantial security improvement for the least effort... Of course personally - I roll dice, dice that I whittled out of sticks, sticks from different trees that I collected from different parks, parks that I visited in a random order based on the results of a PRNG of my own secret design, a PRNG I built out of swarm crab based logic gates on a secret beach, seeded with a number collected from a geiger counter and small sample of u238, a geiger counter I constructed from photodiodes and aluminium foil, photodiodes I fabricated out of mud, rocks and fire. One day I hope to finish implementing my own general purpose computer and browser, then I will finally be able to use my passwords :)
- deleted 3y ago[deleted]
- dragontamer 3y agoWell, there's questions like why use 6^5 (46656) words if you're just not going to be rolling six-sided dice? There are other wordlists and dictionaries out there. For example, randomly selecting words from the Basic English Wordlist (https://simple.wikipedia.org/wiki/Wikipedia:Basic_English_combined_wordlist#cite_note-1 https://simple.wikipedia.org/wiki/Wikipedia:Basic_English_co...), a list of 2626 words, could be a better methodology.
- walrus01 3y agoon debian, 'sudo apt install pwgen' pwgen with the -s option will generate 'random' passwords, up to the randomness limit of whatever random source is provided by your kernel and system. https://packages.debian.org/search?keywords=pwgen https://packages.debian.org/search?keywords=pwgen