3 ms·

I've been using a similar diceware generator for years. I think I learned about it from Cryptonomicon? Consider adding the following options: -include-cap

by jmull 2y ago

I've been using a similar diceware generator for years. I think I learned about it from Cryptonomicon? Consider adding the following options: -include-captital (default yes) -include-lower (default yes) -include-symbol (default yes) -include-number (default yes) -min-length (default 8? not sure the common limit) How you implement these would be up to you. For my part, I generate a password and then transform it according to the options, trying to keep the spirit of diceware (as needed -- your generated pw may satisfy the options by chance, depending on the dictionary). E.g, capitalize the first letter, lower-case the last letter, (or prepend A or append z, if there aren't enough letters), put - between first and second word, transform certain vowels to numbers, that sort of thing. There are some subtleties to min-length.

Cthulhu_ 2y ago
While this is fine advice for a generalised password generator, this isn't the point of the linked XKCD comic nor the objective of the post. That is, the complexity of a password increases exponentially based on length, not so much character set. That is, the number of possibilities is squared if in your list of parameters the min-length goes from 8 to 9, changing the character set does not have as dramatic an effect.
- sd9 2y ago
  Yeah, but websites still have asinine requirements. So at least enforcing uppercase, numbers, and symbols, is useful. It doesn’t make your password significantly better, but it allows you to sign up in the first place. I agree that min length is probably not relevant here though.
- jmull 2y ago
  > nor the objective of the post I wouldn't know, I just assumed of the objective is to create a useful password generator. These options aren't for increased entropy, but to satisfy restrictions real-world sites have on passwords. (In fact, you want to be a little careful about how these are implemented to avoid/minimize the loss of entropy. It's a minor irony that these restrictions, intended to lead to stronger passwords, can result in weaker ones.)

by jmull 2y ago

Cthulhu_ 2y ago

While this is fine advice for a generalised password generator, this isn't the point of the linked XKCD comic nor the objective of the post. That is, the complexity of a password increases exponentially based on length, not so much character set. That is, the number of possibilities is squared if in your list of parameters the min-length goes from 8 to 9, changing the character set does not have as dramatic an effect.

sd9 2y ago
Yeah, but websites still have asinine requirements. So at least enforcing uppercase, numbers, and symbols, is useful. It doesn’t make your password significantly better, but it allows you to sign up in the first place. I agree that min length is probably not relevant here though.
jmull 2y ago
> nor the objective of the post I wouldn't know, I just assumed of the objective is to create a useful password generator. These options aren't for increased entropy, but to satisfy restrictions real-world sites have on passwords. (In fact, you want to be a little careful about how these are implemented to avoid/minimize the loss of entropy. It's a minor irony that these restrictions, intended to lead to stronger passwords, can result in weaker ones.)