12 ms·

Hipku – encode any IP address as a haiku

143 points by gabemart 12y ago

101914 12y ago
The idea reminds me of S/Key. 64 bits --> 6 English words http://www.openbsd.org/cgi-bin/man.cgi?query=skey http://www.openbsd.org/cgi-bin/man.cgi?query=skey http://netbsd.gw.com/cgi-bin/man-cgi?skey http://netbsd.gw.com/cgi-bin/man-cgi?skey
- listic 12y ago
  Your link does not work. This S/KEY? http://en.wikipedia.org/wiki/S/KEY http://en.wikipedia.org/wiki/S/KEY
  - 101914 12y ago
    Should work now.
adg001 12y ago
The hungry white ape aches in the ancient canyon. Autumn colors crunch.
- stedaniels 12y ago
  The agile green ape jumps in the ancient mountains. Autumn colors rest.
  - myhf 12y ago
    The weary white wolf yawns in the wind-swept wetlands. Autumn colors blow.
    - ph0rque 12y ago
      Hey now, who downvotes haikus? Even if random? Must be Hacker News. (not my actual IP)
w8rbt 12y ago
Interesting concept. Somehow, humans need to be able to quickly and clearly say/pronounce an IPv6 address over the phone when talking with Tech Support. Not everyone knows ITU phonetics (two charlie eight foxtrot...). I bet there are other, even simpler ways to human encode IPv6 addresses (outside of DNS names of course).
blfr 12y ago
With IPv6, you can give each site a separate address and encode it as a haiku. Poetry to replace DNS. And there is no central Internet Corporation for Assigned Haiku. This is what namecoin was meant to be. Chilled apes and fat sprats aid bleak brave prone ace ace ants. Ace ants aid sharp beaks.
- lmm 12y ago
  > And there is no central Internet Corporation for Assigned Haiku. Um, yes there is. It's an address; you get your address space from your upstream AS (probably your ISP), they get it from their RIR, and they get their addresses from IANA.
falcolas 12y ago
I love it. The practical side of me, however, would recommend increasing the name space a little bit and adding checksums; human memory is not perfect, and having built-in error correction would help immensely.
- gabemart 12y ago
  Great idea. Thanks. I need to find some extra space for fitting in a version number anyway, to preserve backward-compatibility.
  - e12e 12y ago
    I've been thinking about something similar to this for secure passwords. And your haikus neatly demonstrate both the challenge and viability. I was thinking of encoding as a phrase, but keeping the two first letters of each word in a 256-word set unique, so that a phrase could be used for memorization, but you'd "only" have to type the two first letters of every word. But 16 characters for 64 bits of entropy is still pretty long (for password entry) -- and ideally you'd want 96 or even 128 bits. Especially for passwords/pass phrases that are used to derive/protect encryption keys (the goal being to avoid having the entropy of the password as the weakest link. There are still other challenges with passwords, of course. Eg: key loggers). I'd also thought about having a generic library, that could be used for things like representing hashes/fingerprints etc (think: an alternative to the ssh key ascii art). While I'd considered poetry (especially using rhyming dictionaries) -- my main idea so far is to just construct grammatically well-formed sentences. With a limited vocabulary, it should be easy enough... And as touched upon in this post, it might make a nice alternative for verbally communicating 64-128 bits of random data -- say reading out a password while someone across the server room types it into a console. [edit: eg, using a random haiku: Hoarse dunes and slim germs gulp pure ripe foul dead bland sole. Firm trees bleed short heads. This would become: "hoduslgegupurifodeblsofitrblshhe" (ignoring the and). If anyone wonders why you'd not just type in the whole thing: it's hard, even for a skilled typist, to get something so long, exactly right, when typing blind. And obviously even the short form here strains typing ability. But then again, how many can say with confidence that their passwords hold 128 bits worth of entropy? With a one-to-one mapping between word-lists (or equivalently sets of two leading characters, and a random N bit integer, assuming the integer is as random as your other secret/session keys -- it's trivial to demonstrate a lower bound for the entropy of such a password] [edit2: I should add that I considered adding a standard transform to the final password: capitalize the first letter, and terminate with a punctuation mark. It would add nothing to the entropy of the password, but might allow an "insecure" lowercase-only password to pass inane "strength" requirements, by mixing three character classes.]
krick 12y ago
I don't find this particular app very useful, but the very idea of encoding something hard to read into redundant, but easily comprehensible format is simply great.
e12e 12y ago
Two notable addresses: ::1 Ace ants and ace ants aid ace ace ace ace ace ants. Ace ants aid ace apes. 127.0.0.1 The hungry white ape aches in the ancient canyon. Autumn colors crunch. We can see that ipv6 adds ants to the traditionally monkey themed localhost...
jmnicolas 12y ago
I'm looking for flaws to using this as a password remembering scheme. Basically you remember the haiku but when it comes to typing your password you convert it in an IP address using Hipku. I guess an IPV6 address makes a really strong password, not breakable using a dictionary. Any thoughts on the validity of this use case ?
- kndyry 12y ago
  That's an interesting use case, so I thought I'd compare it against something like diceware[0] which is dictionary based but generally accepted to have strong levels of entropy. N.b.: I'm using a Shannon calculator[1]. Let's use the two most forthcoming examples on hand, that is: the IPv6 address from this article's demo, A = 29A1:A600:F19B:B703:7080:5387:3685:A2AF, and the diceware example from xkcd/936, B = correct horse battery staple[2]. Using the Shannon entropy calculator, we find that A has entropy H(X) = 3.55397. The same analysis of B returns H(X) = 3.49468. Now that's Shannon entropy which calculates the entropy of an outcome in relation to itself, and not the entropy of an outcome from a set of potential outcomes. To do that, we might start with analyzing the number of potential outcomes an IPv6 address can take (340 undecillion[3]) versus the number of words on our diceware list (~7,776 English words[0]) by the number of words our diceware passphrase potentially uses. In the case of IPv6, you have a 'finite' number of combinations, albeit of fixed length, whereas the unfixedness of diceware means that, theoretically, the scheme scales upward into infinity. That's probably not practical, and one could simply add additional sets to an IPv6 address in order to remove that advantage. So, where does that leave us? Well, I'm not sure that I'd like to say, but at least I can examine things this way: using an IPv6 address is probably secure, but is the added overhead of a translating agent between your memorization utility and password input worth it? At least, when compared against something like a four word diceware passphrase, it seems the entropic gains perhaps aren't worth the additional computational overhead. [0] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [1] http://www.shannonentropy.netmark.pl http://www.shannonentropy.netmark.pl [2] http://xkcd.com/936/ http://xkcd.com/936/ [3] http://en.wikipedia.org/wiki/IPv6 http://en.wikipedia.org/wiki/IPv6
- gabemart 12y ago
  I think you'd be better off designing a scheme for generating secure, easy-to-remember passwords in the first place rather than using hipku. I had to make a lot of compromises to make the entire IPv6 space fit into a haiku. For example, hipku uses many one-syllable words which are relatively obscure, and it uses some words that are very similar to other words it uses. Without the constraint of fitting an IPv6 address into a haiku, you wouldn't have to accept these compromises. I think it would be better to generate passwords that were a little longer (while still covering a 128 bit space) but much less ambiguous and easier to remember. It would be pretty easy to do.
lmm 12y ago
Reminds me of http://en.wikipedia.org/wiki/PGP_word_list http://en.wikipedia.org/wiki/PGP_word_list , which is less poetic, but designed to be unambiguous when read over the phone.
- e12e 12y ago
  The ideas behind that list is good, but I think they went overboard with their machine learning approach to find words that were as far apart as possible in pronunciation. Considering one would think that such a list will be used in international contexts, basing it off of Basic English[1] or something would probably have been a better idea. How many non-native speakers (that aren't a fan of Dave Sim's "Cerberus") will know the word "Aardvark" ? [1] http://en.wikipedia.org/wiki/Basic_English http://en.wikipedia.org/wiki/Basic_English
api 12y ago
The length of IPv6 addresses is a minor usability problem from a devops perspective. I don't feel like this is a solution, but something to help ease the pain of this would be nice. Another issue is that nearly all terminal emulators are (so far) too stupid to auto-highlight an IPv6 address on double-click. They all break on : -- highlighting only 16 bits of the address. Annoying.
- _kst_ 12y ago
  That's often configurable. For example, in xterm: > -cc characterclassrange:value[,...] > This sets classes indicated by the given ranges for using in selecting by words. See the section specifying character classes. and discussion of the charClass resource. (I haven't tried using this myself.)
lachenmayer 12y ago
Related: proquints (PRO-nouncable QUIN-tuplets) http://arxiv.org/html/0901.4016 http://arxiv.org/html/0901.4016 127.0.0.1 lusab-babad 63.84.220.193 gutih-tugad 63.118.7.35 gutuk-bisog 140.98.193.141 mudof-sakat 64.255.6.200 haguz-biram
aareet 12y ago
This is fun! I'd have liked to have seen my IP address auto-detected and presented to me as a Hipku so I didn't have to go figure it out and come back to see the results.
- gabemart 12y ago
  I thought this was a fun idea so I did this: http://hipku.gabrielmartin.net http://hipku.gabrielmartin.net

143 points by gabemart 12y ago

101914 12y ago

The idea reminds me of S/Key. 64 bits --> 6 English words http://www.openbsd.org/cgi-bin/man.cgi?query=skey http://www.openbsd.org/cgi-bin/man.cgi?query=skey http://netbsd.gw.com/cgi-bin/man-cgi?skey http://netbsd.gw.com/cgi-bin/man-cgi?skey

listic 12y ago
Your link does not work. This S/KEY? http://en.wikipedia.org/wiki/S/KEY http://en.wikipedia.org/wiki/S/KEY
- 101914 12y ago
  Should work now.

adg001 12y ago

The hungry white ape aches in the ancient canyon. Autumn colors crunch.

stedaniels 12y ago
The agile green ape jumps in the ancient mountains. Autumn colors rest.
- myhf 12y ago
  The weary white wolf yawns in the wind-swept wetlands. Autumn colors blow.
  - ph0rque 12y ago
    Hey now, who downvotes haikus? Even if random? Must be Hacker News. (not my actual IP)

w8rbt 12y ago

Interesting concept. Somehow, humans need to be able to quickly and clearly say/pronounce an IPv6 address over the phone when talking with Tech Support. Not everyone knows ITU phonetics (two charlie eight foxtrot...). I bet there are other, even simpler ways to human encode IPv6 addresses (outside of DNS names of course).

blfr 12y ago

With IPv6, you can give each site a separate address and encode it as a haiku. Poetry to replace DNS. And there is no central Internet Corporation for Assigned Haiku. This is what namecoin was meant to be. Chilled apes and fat sprats aid bleak brave prone ace ace ants. Ace ants aid sharp beaks.

lmm 12y ago
> And there is no central Internet Corporation for Assigned Haiku. Um, yes there is. It's an address; you get your address space from your upstream AS (probably your ISP), they get it from their RIR, and they get their addresses from IANA.

falcolas 12y ago

I love it. The practical side of me, however, would recommend increasing the name space a little bit and adding checksums; human memory is not perfect, and having built-in error correction would help immensely.

gabemart 12y ago
Great idea. Thanks. I need to find some extra space for fitting in a version number anyway, to preserve backward-compatibility.
- e12e 12y ago
  I've been thinking about something similar to this for secure passwords. And your haikus neatly demonstrate both the challenge and viability. I was thinking of encoding as a phrase, but keeping the two first letters of each word in a 256-word set unique, so that a phrase could be used for memorization, but you'd "only" have to type the two first letters of every word. But 16 characters for 64 bits of entropy is still pretty long (for password entry) -- and ideally you'd want 96 or even 128 bits. Especially for passwords/pass phrases that are used to derive/protect encryption keys (the goal being to avoid having the entropy of the password as the weakest link. There are still other challenges with passwords, of course. Eg: key loggers). I'd also thought about having a generic library, that could be used for things like representing hashes/fingerprints etc (think: an alternative to the ssh key ascii art). While I'd considered poetry (especially using rhyming dictionaries) -- my main idea so far is to just construct grammatically well-formed sentences. With a limited vocabulary, it should be easy enough... And as touched upon in this post, it might make a nice alternative for verbally communicating 64-128 bits of random data -- say reading out a password while someone across the server room types it into a console. [edit: eg, using a random haiku: Hoarse dunes and slim germs gulp pure ripe foul dead bland sole. Firm trees bleed short heads. This would become: "hoduslgegupurifodeblsofitrblshhe" (ignoring the and). If anyone wonders why you'd not just type in the whole thing: it's hard, even for a skilled typist, to get something so long, exactly right, when typing blind. And obviously even the short form here strains typing ability. But then again, how many can say with confidence that their passwords hold 128 bits worth of entropy? With a one-to-one mapping between word-lists (or equivalently sets of two leading characters, and a random N bit integer, assuming the integer is as random as your other secret/session keys -- it's trivial to demonstrate a lower bound for the entropy of such a password] [edit2: I should add that I considered adding a standard transform to the final password: capitalize the first letter, and terminate with a punctuation mark. It would add nothing to the entropy of the password, but might allow an "insecure" lowercase-only password to pass inane "strength" requirements, by mixing three character classes.]

krick 12y ago

I don't find this particular app very useful, but the very idea of encoding something hard to read into redundant, but easily comprehensible format is simply great.

e12e 12y ago

Two notable addresses: ::1 Ace ants and ace ants aid ace ace ace ace ace ants. Ace ants aid ace apes. 127.0.0.1 The hungry white ape aches in the ancient canyon. Autumn colors crunch. We can see that ipv6 adds ants to the traditionally monkey themed localhost...

jmnicolas 12y ago

I'm looking for flaws to using this as a password remembering scheme. Basically you remember the haiku but when it comes to typing your password you convert it in an IP address using Hipku. I guess an IPV6 address makes a really strong password, not breakable using a dictionary. Any thoughts on the validity of this use case ?

kndyry 12y ago
That's an interesting use case, so I thought I'd compare it against something like diceware[0] which is dictionary based but generally accepted to have strong levels of entropy. N.b.: I'm using a Shannon calculator[1]. Let's use the two most forthcoming examples on hand, that is: the IPv6 address from this article's demo, A = 29A1:A600:F19B:B703:7080:5387:3685:A2AF, and the diceware example from xkcd/936, B = correct horse battery staple[2]. Using the Shannon entropy calculator, we find that A has entropy H(X) = 3.55397. The same analysis of B returns H(X) = 3.49468. Now that's Shannon entropy which calculates the entropy of an outcome in relation to itself, and not the entropy of an outcome from a set of potential outcomes. To do that, we might start with analyzing the number of potential outcomes an IPv6 address can take (340 undecillion[3]) versus the number of words on our diceware list (~7,776 English words[0]) by the number of words our diceware passphrase potentially uses. In the case of IPv6, you have a 'finite' number of combinations, albeit of fixed length, whereas the unfixedness of diceware means that, theoretically, the scheme scales upward into infinity. That's probably not practical, and one could simply add additional sets to an IPv6 address in order to remove that advantage. So, where does that leave us? Well, I'm not sure that I'd like to say, but at least I can examine things this way: using an IPv6 address is probably secure, but is the added overhead of a translating agent between your memorization utility and password input worth it? At least, when compared against something like a four word diceware passphrase, it seems the entropic gains perhaps aren't worth the additional computational overhead. [0] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [1] http://www.shannonentropy.netmark.pl http://www.shannonentropy.netmark.pl [2] http://xkcd.com/936/ http://xkcd.com/936/ [3] http://en.wikipedia.org/wiki/IPv6 http://en.wikipedia.org/wiki/IPv6
gabemart 12y ago
I think you'd be better off designing a scheme for generating secure, easy-to-remember passwords in the first place rather than using hipku. I had to make a lot of compromises to make the entire IPv6 space fit into a haiku. For example, hipku uses many one-syllable words which are relatively obscure, and it uses some words that are very similar to other words it uses. Without the constraint of fitting an IPv6 address into a haiku, you wouldn't have to accept these compromises. I think it would be better to generate passwords that were a little longer (while still covering a 128 bit space) but much less ambiguous and easier to remember. It would be pretty easy to do.

lmm 12y ago

Reminds me of http://en.wikipedia.org/wiki/PGP_word_list http://en.wikipedia.org/wiki/PGP_word_list , which is less poetic, but designed to be unambiguous when read over the phone.

e12e 12y ago
The ideas behind that list is good, but I think they went overboard with their machine learning approach to find words that were as far apart as possible in pronunciation. Considering one would think that such a list will be used in international contexts, basing it off of Basic English[1] or something would probably have been a better idea. How many non-native speakers (that aren't a fan of Dave Sim's "Cerberus") will know the word "Aardvark" ? [1] http://en.wikipedia.org/wiki/Basic_English http://en.wikipedia.org/wiki/Basic_English

api 12y ago

The length of IPv6 addresses is a minor usability problem from a devops perspective. I don't feel like this is a solution, but something to help ease the pain of this would be nice. Another issue is that nearly all terminal emulators are (so far) too stupid to auto-highlight an IPv6 address on double-click. They all break on : -- highlighting only 16 bits of the address. Annoying.

_kst_ 12y ago
That's often configurable. For example, in xterm: > -cc characterclassrange:value[,...] > This sets classes indicated by the given ranges for using in selecting by words. See the section specifying character classes. and discussion of the charClass resource. (I haven't tried using this myself.)

lachenmayer 12y ago

Related: proquints (PRO-nouncable QUIN-tuplets) http://arxiv.org/html/0901.4016 http://arxiv.org/html/0901.4016 127.0.0.1 lusab-babad 63.84.220.193 gutih-tugad 63.118.7.35 gutuk-bisog 140.98.193.141 mudof-sakat 64.255.6.200 haguz-biram

aareet 12y ago

This is fun! I'd have liked to have seen my IP address auto-detected and presented to me as a Hipku so I didn't have to go figure it out and come back to see the results.

gabemart 12y ago
I thought this was a fun idea so I did this: http://hipku.gabrielmartin.net http://hipku.gabrielmartin.net