4 ms·

I'm looking for flaws to using this as a password remembering scheme. Basically you remember the haiku but when it comes to typing your password you convert it

I'm looking for flaws to using this as a password remembering scheme. Basically you remember the haiku but when it comes to typing your password you convert it in an IP address using Hipku. I guess an IPV6 address makes a really strong password, not breakable using a dictionary. Any thoughts on the validity of this use case ?

kndyry 12y ago
That's an interesting use case, so I thought I'd compare it against something like diceware[0] which is dictionary based but generally accepted to have strong levels of entropy. N.b.: I'm using a Shannon calculator[1]. Let's use the two most forthcoming examples on hand, that is: the IPv6 address from this article's demo, A = 29A1:A600:F19B:B703:7080:5387:3685:A2AF, and the diceware example from xkcd/936, B = correct horse battery staple[2]. Using the Shannon entropy calculator, we find that A has entropy H(X) = 3.55397. The same analysis of B returns H(X) = 3.49468. Now that's Shannon entropy which calculates the entropy of an outcome in relation to itself, and not the entropy of an outcome from a set of potential outcomes. To do that, we might start with analyzing the number of potential outcomes an IPv6 address can take (340 undecillion[3]) versus the number of words on our diceware list (~7,776 English words[0]) by the number of words our diceware passphrase potentially uses. In the case of IPv6, you have a 'finite' number of combinations, albeit of fixed length, whereas the unfixedness of diceware means that, theoretically, the scheme scales upward into infinity. That's probably not practical, and one could simply add additional sets to an IPv6 address in order to remove that advantage. So, where does that leave us? Well, I'm not sure that I'd like to say, but at least I can examine things this way: using an IPv6 address is probably secure, but is the added overhead of a translating agent between your memorization utility and password input worth it? At least, when compared against something like a four word diceware passphrase, it seems the entropic gains perhaps aren't worth the additional computational overhead. [0] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [1] http://www.shannonentropy.netmark.pl http://www.shannonentropy.netmark.pl [2] http://xkcd.com/936/ http://xkcd.com/936/ [3] http://en.wikipedia.org/wiki/IPv6 http://en.wikipedia.org/wiki/IPv6
gabemart 12y ago
I think you'd be better off designing a scheme for generating secure, easy-to-remember passwords in the first place rather than using hipku. I had to make a lot of compromises to make the entire IPv6 space fit into a haiku. For example, hipku uses many one-syllable words which are relatively obscure, and it uses some words that are very similar to other words it uses. Without the constraint of fitting an IPv6 address into a haiku, you wouldn't have to accept these compromises. I think it would be better to generate passwords that were a little longer (while still covering a 128 bit space) but much less ambiguous and easier to remember. It would be pretty easy to do.
lmm 12y ago
You might as well use the full length haiku - you wouldn't be exposing it to an external service, you wouldn't need internet access or a program installed, and you can probably type it faster than the IPv6 address. Using dictionary words for a passphrase is actually fine as long as the phrase is long enough. Figure out how much security you need (128 bits if you're going with the IPv6 example).
- e12e 12y ago
  The problem with using the whole haikus, is that you must type quite a lot, typically blindly, into a password entry field -- and not make a single mistake. I think the more interesting question is: if you manage to memorize the haiku -- will you be able to retain it longer than the ipv6 address? After typing in the address a few times a day, you'd have it memorized (at least in muscle memory). But what if this was something you either used rarely (passphrase for restoring backups for example). Would you remember the haiku even after you'd forgot the ipv6 address?
  - lmm 12y ago
    If you memorize poems at all you have to remember the exact words; IMO they're easier than memorizing numbers. (In fact, the way I can remember the first 50-or-so digits of pi is that someone wrote a poem where the word-lengths correspond to the digits).
    - e12e 12y ago
      It's not that it's hard to remember, it's hard to type in. At least that's my experience (I use a few 16+ character passwords/passphrases). It might be easier if it's all lower-case, no numbers etc -- I'm not sure -- I've not tested myself. But in writing the above, I had to hit backspace at least once -- something that's a bit hard to catch when you're typing blind into a password entry field, like when typing in the pass-phrase for unlocking a LUKS partition, or logging into a console session. Or even typing in a login password in a graphical login manager, like the windows login prompt, or gdm/ldm/xdm etc. And it also takes time. Especially if you only get it right on your third attempt.

kndyry 12y ago

That's an interesting use case, so I thought I'd compare it against something like diceware[0] which is dictionary based but generally accepted to have strong levels of entropy. N.b.: I'm using a Shannon calculator[1]. Let's use the two most forthcoming examples on hand, that is: the IPv6 address from this article's demo, A = 29A1:A600:F19B:B703:7080:5387:3685:A2AF, and the diceware example from xkcd/936, B = correct horse battery staple[2]. Using the Shannon entropy calculator, we find that A has entropy H(X) = 3.55397. The same analysis of B returns H(X) = 3.49468. Now that's Shannon entropy which calculates the entropy of an outcome in relation to itself, and not the entropy of an outcome from a set of potential outcomes. To do that, we might start with analyzing the number of potential outcomes an IPv6 address can take (340 undecillion[3]) versus the number of words on our diceware list (~7,776 English words[0]) by the number of words our diceware passphrase potentially uses. In the case of IPv6, you have a 'finite' number of combinations, albeit of fixed length, whereas the unfixedness of diceware means that, theoretically, the scheme scales upward into infinity. That's probably not practical, and one could simply add additional sets to an IPv6 address in order to remove that advantage. So, where does that leave us? Well, I'm not sure that I'd like to say, but at least I can examine things this way: using an IPv6 address is probably secure, but is the added overhead of a translating agent between your memorization utility and password input worth it? At least, when compared against something like a four word diceware passphrase, it seems the entropic gains perhaps aren't worth the additional computational overhead. [0] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html [1] http://www.shannonentropy.netmark.pl http://www.shannonentropy.netmark.pl [2] http://xkcd.com/936/ http://xkcd.com/936/ [3] http://en.wikipedia.org/wiki/IPv6 http://en.wikipedia.org/wiki/IPv6

gabemart 12y ago

I think you'd be better off designing a scheme for generating secure, easy-to-remember passwords in the first place rather than using hipku. I had to make a lot of compromises to make the entire IPv6 space fit into a haiku. For example, hipku uses many one-syllable words which are relatively obscure, and it uses some words that are very similar to other words it uses. Without the constraint of fitting an IPv6 address into a haiku, you wouldn't have to accept these compromises. I think it would be better to generate passwords that were a little longer (while still covering a 128 bit space) but much less ambiguous and easier to remember. It would be pretty easy to do.

lmm 12y ago

You might as well use the full length haiku - you wouldn't be exposing it to an external service, you wouldn't need internet access or a program installed, and you can probably type it faster than the IPv6 address. Using dictionary words for a passphrase is actually fine as long as the phrase is long enough. Figure out how much security you need (128 bits if you're going with the IPv6 example).

e12e 12y ago
The problem with using the whole haikus, is that you must type quite a lot, typically blindly, into a password entry field -- and not make a single mistake. I think the more interesting question is: if you manage to memorize the haiku -- will you be able to retain it longer than the ipv6 address? After typing in the address a few times a day, you'd have it memorized (at least in muscle memory). But what if this was something you either used rarely (passphrase for restoring backups for example). Would you remember the haiku even after you'd forgot the ipv6 address?
- lmm 12y ago
  If you memorize poems at all you have to remember the exact words; IMO they're easier than memorizing numbers. (In fact, the way I can remember the first 50-or-so digits of pi is that someone wrote a poem where the word-lengths correspond to the digits).
  - e12e 12y ago
    It's not that it's hard to remember, it's hard to type in. At least that's my experience (I use a few 16+ character passwords/passphrases). It might be easier if it's all lower-case, no numbers etc -- I'm not sure -- I've not tested myself. But in writing the above, I had to hit backspace at least once -- something that's a bit hard to catch when you're typing blind into a password entry field, like when typing in the pass-phrase for unlocking a LUKS partition, or logging into a console session. Or even typing in a login password in a graphical login manager, like the windows login prompt, or gdm/ldm/xdm etc. And it also takes time. Especially if you only get it right on your third attempt.