4 ms·

Everybody is dancing around reality: passwords are incompatible with the average person. The best passwords are almost always difficult to memorize and once the

by lhnz 15y ago

Everybody is dancing around reality: passwords are incompatible with the average person. The best passwords are almost always difficult to memorize and once they are memorized it is costly for us to change them. It's an ill-fitting solution to a social problem.

nknight 15y ago
A random 4-word passphrase is more than enough to stop online attacks against high-value targets (e.g. bank accounts) that have any throttling at all. A random 5-word passphrase with three random characters tossed at the end has better than 82 bits of entropy and will halt offline attacks, at least by non-TLAs, for many years to come. These are not hard to memorize. What's hard to memorize is 101 different passphrases, many of which you don't use every day, which is why the people actively working to make it easier are focusing on the management problem.
- drostie 15y ago
  Just to give people a flavor, here is a script I wrote in Python to generate various random passwords: http://www.bpaste.net/show/24775/ http://www.bpaste.net/show/24775/ What it looks like in practice: drostie@signy:~$ words -c 5 4 (Line entropy: 64.7055497954 bits.) rebelliousness subpoenas garrulous coach mono peroxide underused fathers entreat entwined meatier umbilicuses relay torrential husband Jenkins Kristine sluggers feverishly Lessie So each of those lines has a little over 64 bits of entropy. You might also consider the following one-liner in the shell: drostie@signy:~$ head -c 9 /dev/urandom | base64 ST2QpSb0eKHk If you're not paranoid, consider typing "password" into DuckDuckGo and it will give you a random password. If you're slightly more paranoid, consider using mouse-movements to generate your own random password with a random tool I coded for making random API keys: http://code.drostie.org/api.html http://code.drostie.org/api.html . Just truncate to the first 10-12 characters or so.
danieldk 15y ago
That's why password managers are so useful. For every service a user can use a different strong password, but for the user there is only one password. Of course, password managers have their weaknesses (a compromised system will often give access to all accounts, rather than just a few), but it is far more secure than having people using the same trivial password for every service.
- pnathan 15y ago
  Also, if you forget your password to the password manager... :)
  - deleted 15y ago
    [deleted]
  - drucken 15y ago
    It is a single password/pass phrase. This makes it simple to manage. You can easily create a simple paper and geographically-redundant system (e.g. using a one-time pad) that means you can keep the passphrase in the open, for example, in your wallet or purse. Password managers are the only way to go and eventually all password/passphrase users realise this because they end-up emulating these systems anyway (e.g. using extemely poor entropy additions to their existing passwords for different applications).
DanBC 15y ago
Passwords are only hard to memorize because of the old advice about "do not write them down". But really, if you write a password on a $50 dollar bill you're not likely to then stick it to your monitor or leave it under a draw. You'd keep it in your wallet, and you hopefully keep that safe. Once you've remembered the password you can destroy the bit of paper. (uh, not a $50!) I'd be interested to see if there's a bias in words that are selected by people when using a diceware system. People generate a passphrase, but then say "I won't use the first word because I can't remember it, I'll just generate another word". Also whether that would lead to exploitable weakness.
- drostie 15y ago
  Passwords are also much easier to memorize when you have to use them every few days, and extremely hard to remember when you only use them once every several months when your login cookie expires. I also would like to know whether there is a simple way to strongly encrypt a password that one keeps in one's wallet. The goal should be that if I am pickpocketed in a Dutch train (which seemingly never happens but the Dutch always warn me about it), my wallet does not contain some piece of paper saying "my.address@gmail.com h6tHVtcj3DsY".
  - minikomi 15y ago
    Anagrams .. Something that looks like it should be in a wallet (eg shopping list) .. Use the sum of the digits on your credit card plus a word
vacri 15y ago
"Everybody is dancing around reality:" This is a fine password. Long, easy to remember, and has five special characters.
kruhft 15y ago
Whoever solves the 'password problem' and has their solution adopted is going to make a lot of money, I think. I'm always working on this in the back of my head, but haven't come up with something that will really work, but I'm sure someday, someone will come up with a solution that is a secure, reliable and easy to use way of personal identification.
tomjen3 15y ago
For offline encrytion that is true, but if you rate limit the login attempts (to something like once every 3 seconds after 4 tries) then even a password with 20 bits of entropy is going to take a riddicously long time to bruteforce.

by lhnz 15y ago

nknight 15y ago

A random 4-word passphrase is more than enough to stop online attacks against high-value targets (e.g. bank accounts) that have any throttling at all. A random 5-word passphrase with three random characters tossed at the end has better than 82 bits of entropy and will halt offline attacks, at least by non-TLAs, for many years to come. These are not hard to memorize. What's hard to memorize is 101 different passphrases, many of which you don't use every day, which is why the people actively working to make it easier are focusing on the management problem.

drostie 15y ago
Just to give people a flavor, here is a script I wrote in Python to generate various random passwords: http://www.bpaste.net/show/24775/ http://www.bpaste.net/show/24775/ What it looks like in practice: drostie@signy:~$ words -c 5 4 (Line entropy: 64.7055497954 bits.) rebelliousness subpoenas garrulous coach mono peroxide underused fathers entreat entwined meatier umbilicuses relay torrential husband Jenkins Kristine sluggers feverishly Lessie So each of those lines has a little over 64 bits of entropy. You might also consider the following one-liner in the shell: drostie@signy:~$ head -c 9 /dev/urandom | base64 ST2QpSb0eKHk If you're not paranoid, consider typing "password" into DuckDuckGo and it will give you a random password. If you're slightly more paranoid, consider using mouse-movements to generate your own random password with a random tool I coded for making random API keys: http://code.drostie.org/api.html http://code.drostie.org/api.html . Just truncate to the first 10-12 characters or so.

danieldk 15y ago

That's why password managers are so useful. For every service a user can use a different strong password, but for the user there is only one password. Of course, password managers have their weaknesses (a compromised system will often give access to all accounts, rather than just a few), but it is far more secure than having people using the same trivial password for every service.

pnathan 15y ago
Also, if you forget your password to the password manager... :)
- deleted 15y ago
  [deleted]
- drucken 15y ago
  It is a single password/pass phrase. This makes it simple to manage. You can easily create a simple paper and geographically-redundant system (e.g. using a one-time pad) that means you can keep the passphrase in the open, for example, in your wallet or purse. Password managers are the only way to go and eventually all password/passphrase users realise this because they end-up emulating these systems anyway (e.g. using extemely poor entropy additions to their existing passwords for different applications).

DanBC 15y ago

Passwords are only hard to memorize because of the old advice about "do not write them down". But really, if you write a password on a $50 dollar bill you're not likely to then stick it to your monitor or leave it under a draw. You'd keep it in your wallet, and you hopefully keep that safe. Once you've remembered the password you can destroy the bit of paper. (uh, not a $50!) I'd be interested to see if there's a bias in words that are selected by people when using a diceware system. People generate a passphrase, but then say "I won't use the first word because I can't remember it, I'll just generate another word". Also whether that would lead to exploitable weakness.

drostie 15y ago
Passwords are also much easier to memorize when you have to use them every few days, and extremely hard to remember when you only use them once every several months when your login cookie expires. I also would like to know whether there is a simple way to strongly encrypt a password that one keeps in one's wallet. The goal should be that if I am pickpocketed in a Dutch train (which seemingly never happens but the Dutch always warn me about it), my wallet does not contain some piece of paper saying "my.address@gmail.com h6tHVtcj3DsY".
- minikomi 15y ago
  Anagrams .. Something that looks like it should be in a wallet (eg shopping list) .. Use the sum of the digits on your credit card plus a word

vacri 15y ago

"Everybody is dancing around reality:" This is a fine password. Long, easy to remember, and has five special characters.

kruhft 15y ago

Whoever solves the 'password problem' and has their solution adopted is going to make a lot of money, I think. I'm always working on this in the back of my head, but haven't come up with something that will really work, but I'm sure someday, someone will come up with a solution that is a secure, reliable and easy to use way of personal identification.

tomjen3 15y ago

For offline encrytion that is true, but if you rate limit the login attempts (to something like once every 3 seconds after 4 tries) then even a password with 20 bits of entropy is going to take a riddicously long time to bruteforce.