4 ms·

Since reading that xkcd, I use phrases as passwords, using a simple Ruby script to generate them: w = File.readlines('/usr/share/dict/words').map { |w| w.cho

by sspiff 14y ago

Since reading that xkcd, I use phrases as passwords, using a simple Ruby script to generate them: w = File.readlines('/usr/share/dict/words').map { |w| w.chomp }.reject { |w| w !~ /^[A-Za-z]+$/ }; 3.times { print w[rand * w.size] }; puts I generally get an easy to remember password after about 3 tries. The biggest issue I have with this is typing in passwords on mobile devices.

_ikke_ 14y ago
Aren't phrases easier to type on mobile devices than letter / number combinations? I always find it annoying to have to switch to different keyboard modes (text / numbers), or having to hold the letter / number key for a few seconds.
- sspiff 14y ago
  Sure, the simple characters make it a bit easier, but the phrases tend to be much longer. The error rate on a touchscreen keyboard is high enough to really become a problem at 20+ characters when you only see the last typed character (no password review).
  - Karunamon 14y ago
    Using dictionary words makes it easy for more modern predictive keyboards to keep up, though. Taking the XKCD canonical example, "correct horse battery staple", it's a reasonably secure and lengthy password and includes special characters. It could also be keyed in via something like Swype or SlideIT in almost as fast as it could be keyed in on a computer keyboard.
    - sspiff 14y ago
      Perhaps, depending on the user. Doesn't work well for me though.
- rootbear 14y ago
  Yeah, the iPhone keyboard is what finally got me to stop using r2d2 or c3p0 as a part of my password. And the fact that they are probably in the cracking dictionaries.
trebor 14y ago
A slight refactoring for Ruby 1.9.3 users, uses Array#sample to grab 3 random words, etc. ruby -e 'w = File.readlines("/usr/share/dict/words").map { |w| w.chomp }.reject { |w| w !~ /^[A-Za-z]+$/ }; puts w.sample(3).join(" ").downcase'
CodesInChaos 14y ago
Is `rand` a secure random number in ruby? In many programming languages/implementations the default PRNG is only seeded with the current time, which leads to quite low entropy.

by sspiff 14y ago

_ikke_ 14y ago

Aren't phrases easier to type on mobile devices than letter / number combinations? I always find it annoying to have to switch to different keyboard modes (text / numbers), or having to hold the letter / number key for a few seconds.

sspiff 14y ago
Sure, the simple characters make it a bit easier, but the phrases tend to be much longer. The error rate on a touchscreen keyboard is high enough to really become a problem at 20+ characters when you only see the last typed character (no password review).
- Karunamon 14y ago
  Using dictionary words makes it easy for more modern predictive keyboards to keep up, though. Taking the XKCD canonical example, "correct horse battery staple", it's a reasonably secure and lengthy password and includes special characters. It could also be keyed in via something like Swype or SlideIT in almost as fast as it could be keyed in on a computer keyboard.
  - sspiff 14y ago
    Perhaps, depending on the user. Doesn't work well for me though.
rootbear 14y ago
Yeah, the iPhone keyboard is what finally got me to stop using r2d2 or c3p0 as a part of my password. And the fact that they are probably in the cracking dictionaries.

trebor 14y ago

A slight refactoring for Ruby 1.9.3 users, uses Array#sample to grab 3 random words, etc. ruby -e 'w = File.readlines("/usr/share/dict/words").map { |w| w.chomp }.reject { |w| w !~ /^[A-Za-z]+$/ }; puts w.sample(3).join(" ").downcase'

CodesInChaos 14y ago

Is `rand` a secure random number in ruby? In many programming languages/implementations the default PRNG is only seeded with the current time, which leads to quite low entropy.