7 ms·
> Each entry has about 42 bits of randomness. Queries are not recorded. Randomness is probably as good as the random resource in the operating system. Hmmm.
by enriquto 3y ago
> Each entry has about 42 bits of randomness. Queries are not recorded.
Randomness is probably as good as the random resource in the operating system.
Hmmm. Such a statement should be backed by proof, not by trust. Until you can run the code locally you can't assume that any of these things is true. As far as we know, this can be a reverse password harvesting scheme.
- Dalewyn 3y agoWhile what you say is absolutely true, a cursory skim of the website's webmaster's profile[1] suggests he would be putting a lot of reputation on the line if he were acting maliciously. [1]: https://cheswick.com/ches/cv/index.html https://cheswick.com/ches/cv/index.html EDIT: Pardon my sudden lack of linguistic finesse, clearly the beer I had tonight was good.
- FartyMcFarter 3y agoThat's what they want us to think.
- tomas789 3y agoIt could be a research project so it might still have some neferious purpose to it.
- InsomniacL 3y agoWhen I get hold of good beer, linguistic finesse is not a quality that emerges.
- Culonavirus 3y agoI use https://www.useapassphrase.com/ https://www.useapassphrase.com/ since forever and that uses client side generation (i.e. the password never leaves your browser). And speaking about passphrases... I find it borderline insulting that many sites still use the archaic "whateveR1@" format, like, dude, I just gave you sentence worth of words that will take a bazillion more years to crack than passworD1@ ... some people just learn something in school and then use it for 20 years, I swear.
- lupusreal 3y agoDo you vet the JS this site sends you every time you use if, or do you trust that because it was client side in the past it will always remain so? Also, picking four random words "meat side" is pretty easy in my experience, but using a client side (not browser) password manager neatly solves the "inane password complexity requirements" problem.
- codetrotter 3y agoThis is an opportune moment to plug my command-line passphrase generator. Open source, runs on your machine. It makes passwords like: tiptoeing saxophone wholesaler luxurious leftover codeword eruption gnarly skies taco username affidavit I named it pgen Get it from https://github.com/ctsrc/Pgen https://github.com/ctsrc/Pgen
- keybored 3y agoI use a 1000-line word list, head(1), shuf(1) and then tr(1) to join the lines.
- yjftsjthsd-h 3y agoI've just been using shuf -n 5 /usr/share/dict/words and then manually typing them in, optionally adding any special characters or whatever the particular site requires. Changing 5 as needed, of course.
- usrusr 3y agoSo this is basically the swordfighting sim in the Snow Crash metaverse (well, The metaverse, this one does not require a qualifier), but ported to Monkey Island. Should we take Hiro Protagonist's swordplay acumen as a warning to question the promised randomness?
- throw0101d 3y ago> Such a statement should be backed by proof, not by trust. Just noting that "Cheswick" is the dude that literally (co-)wrote the book on firewalls (1e in 1994): * https://en.wikipedia.org/wiki/Firewalls_and_Internet_Security https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit... * https://en.wikipedia.org/wiki/William_Cheswick https://en.wikipedia.org/wiki/William_Cheswick * https://en.wikipedia.org/wiki/Firewall_(computing) https://en.wikipedia.org/wiki/Firewall_(computing)
- enriquto 3y agoIs this some sort of argument from authority? I'm not accusing the author of anything. But now that you mention him, the man was working at Bell labs during the time when Ken wrote his famous essay "reflections on trusting trust". If he shared just a small part of his colleague's spirit, it would be irresistible to him to log all passwords that thousands of people may decide to use. Mainly as a conversation starter, not to do anything bad with these passwords. Maybe he's gathering cool stories in case of a hypothetical Turing award in the future?
- Hnrobert42 3y agoIt is an argument from authority, but such a critique is less relevant in this context. This is not the examination of a logical argument. GP was arguing that OP is trustworthy because he has a reputation to maintain.
- throw0101d 3y ago> GP was arguing that OP is trustworthy because he has a reputation to maintain. I, the GP, is arguing nothing of the sort.
- Hnrobert42 3y agoThen what was your point? Why else reference the author’s reputation?
- 3y ago
- dylan604 3y agoAccording to the movie, the Enigma was broken because each message closed with the exact same phrase in every message. These all start with the exact same word. However, anyone taking this thing as anything more than the jovial manner in which it is intended is not someone that understands a word of what you just said. So it's all just grandstanding for the sake of it
- danbruc 3y ago42 bit is not that much to begin with, you can brute force a simple cryptographic hash in minutes.
- wlesieutre 3y agoAssuming that person trying to brute force your password knows that this passphrase generator exists and starts their search with all possible insult passphrases, otherwise they're searching in a much larger space
- danbruc 3y agoOf course, searching through all eight word combinations will be quite a bit harder. But that does not really protect you that much. If you are attacking passwords, you will try increasingly large sets of possible passwords. After you have gone through the million most common passwords and so on, you will also sooner than later spend a few minutes on trying all those insults before moving on to all eight word combinations, at least if this generator becomes popular enough to warrant inclusion in an attack.