4 ms·
Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4
by runeks 14y ago
Here's a useful one-liner to create a strong password in Linux:
cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4
This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's. The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen. This gives a password with about 65 bits of entropy.
By adding another word, thus creating a 5-word passphrase, a botnet capable of checking 1,000 trillion passwords per second would spend, on average, 1600 years cracking away before it would find the correct passphrase.
Here are some example 4-word passphrases produced using this method:
poetically archaisms accept constrictors
leukemia shuttlecocked checkout benevolently
climactic gyrate dynamical predominates
massage beef Concords recliners
These are surprisingly easy to remember. I use a 7-word passphrase for the most important things and it didn't take me more than a day or two to learn it.
- aiscott 14y agomassage beef Concords recliners Damn you.
- ams6110 14y agoyes, but picking a handful of random words out of the dictionary is not the advice the passphrase advocates are giving. They are saying use a phrase that's meaningful to you and easy to remember.... which means most people are going to use a phrase in their native tongue, just like most people are using passwords like "mylinkedin!" for linked in. Edit: also, for anyone wanting something like the above technique, I recommend Diceware.
- lotharbot 14y ago> "They are saying use a phrase that's meaningful to you" I haven't seen any passphrase advocates say that. The ones I've seen all say "use 4-5 random dictionary words". Come up with a meaning for the phrase, and it'll be easy to remember.
- waffle_ss 14y agoCool! You don't need to use cat, though: egrep -v "é|'s$|[Åå]|[Øø]" /usr/share/dict/words|shuf --random-source=/dev/random -n4
- wazoox 14y agoUUOC. It even has its own several web pages. Start there: http://en.wikipedia.org/wiki/Cat_%28Unix%29#Useless_use_of_cat http://en.wikipedia.org/wiki/Cat_%28Unix%29#Useless_use_of_c...
- ralph 14y agoWhy blacklist rather than whitelist? LC_ALL=C egrep '^[[:lower:]]{4,8}$' /usr/share/dict/words | shuf --random-source=/dev/random -n4 | fmt That's picking from ~35,000 words, which I think is still good enough but avoids ending up with "interpreters incredibility disciplinary constitutionality". (I need the C locale to stop this old GNU grep being painfully slow.)
- jackalope 14y agoThat's only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don't know how long it would take to create a rainbow table for the whole space, which is this big: 72940^4 = 2.8304992 × 10^19 To put it in perspective, a 14-character password using only lower case English alphabet letters as individual tokens already beats this: 26^14 = 6.45099747 × 10^19
- archivator 14y agoThen again, a random string of 14-characters is nearly impossible to remember. The key takeaway here is that every word adds another 16.15 bits (assuming good random source and no non-random decisions by the user), whereas another character adds only 4.7 bits. I'd argue that the effort to remember another 4 random characters (to reach those 16 bits) is far more than the one to remember another random word. We're quite good with words, you know :)
- Periodic 14y agoThe unix utility apg has some nice functions for generating passwords. Particularly I like it's "pronounceable" algorithm which tries to generate passwords that are slightly pronounceable. It's a good way to get those 6-14 character passwords with numbers, upper case, and punctuation that are easier to remember but still random. WeampE6quaph (Weamp-E-SIX-quaph) 2hoov2Klypfo (TWO-hoov-TWO-Klyp-fo) GicutOj8 (Gic-ut-Oj-EIGHT) HegEmWydwev5 (Heg-Em-Wyd-wev-FIVE) Tegdijetyik4 (Teg-dij-et-yik-FOUR) Fon7ochry (Fon-SEVEN-och-ry) I usually take the password and type it about 100 times to see how it feels, subtly changing any characters that feel awkward to type. This gives me a password that is very fast and natural to type (less likely to have errors), but still has a lot of randomness and obeys all the stupid password rules.
- seandougall 14y agoIt should be noted that if you use the same passphrase for your most important things, then it may not matter how uncrackable it is -- if it gets compromised through a method other than cracking, then all your other important accounts are also compromised. Even relatively high-stakes companies like banks and credit card companies make obscenely stupid mistakes when it comes to security. For example, there was a case fairly recently where you could log into your Citibank account and change the account number in the GET query string, and you'd instantly have access to anybody else's account. Given that they're capable of that type of idiocy, all it takes is for one mental giant to decide that encrypting your password is better than hashing it, and you're vulnerable. Malicious behavior isn't the only thing to watch out for. By doing business with the outside world, we're putting ourselves at the mercy of complete morons every day. If you use a different passphrase for every account, then you can at least limit your risk to one service.
- deleted 14y ago[deleted]
- Locke1689 14y agoTo generate random alphanumeric strings drop the following into your zshrc: function mkpw () { if (( $# == 0 )) then head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-12} else head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-$1} fi } By default it generates an alphanumeric string of length 12. Given an integer argument n it generates an alphanumeric string of length n.