5 ms·

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memora

by feld 12y ago

FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember. % ./passphrase.pl 10 coppice-topped belly-naked bastard locust tree diamond bort middle-aged self-mapped air level field gun machine rifle chock stone % ./passphrase.pl 10 self-knowing soul-killing Magna charta fly-killing spring chicken blotting book finger-cone gauge glass Fort union assistant examiner % ./passphrase.pl 10 soya-bean oil foxtail pine island-dotted four-way cock side-bar rule benzoyl hydride straight-fibered steel town stone bramble rag-boiling

TheLoneWolfling 12y ago
Be careful that your "memorability" pruning doesn't reduce the entropy too much.
- feld 12y ago
  You just increase the entropy by adding characters, numbers, etc and keeping it reasonably long (20+ chars). The entropy of my passwords is quite high according to Keepass.
  - heinrich5991 12y ago
    The thing is, you can't determine "entropy" of a password after the creation. It's the creating process that determines how "random" your password is. KeePass's measure is just an approximation, and I have no idea about how accurate it is.
tedunangst 12y ago
Not that odd. All the words from Webster's are in web2, all the compound entries (not strictly "words") are in web2a. That said, "straight-fibered four-way cock" is my new favorite passphrase.
- feld 12y ago
  So that explains where they were sourced from. Thanks!
jrapdx3 12y ago
Using web2a is a great idea. I'd written a Diceware-like password generator in Scheme. The word word list was derived from the web2 list (FreeBSD /usr/share/dict directory). Even after paring it down to ~151000 items, the resulting passwords often contained arcane terms limiting password usability. With the web2a list slightly tweaked, I get many memorable passwords, e.g., "power-weaver-sand-screw-1081" or "cloud-ring-tea-fighting-1107". OTOH web2a is shorter (~76000 entries), giving 2 bits less entropy vs. using the filtered web2 list. Taking password readability into account, the higher rate of "keepers" with web2a probably evens out the difference. BTW the web2a word list is here (https://svnweb.freebsd.org/base/head/share/dict https://svnweb.freebsd.org/base/head/share/dict) in case anyone doesn't have access to it.

by feld 12y ago

TheLoneWolfling 12y ago

Be careful that your "memorability" pruning doesn't reduce the entropy too much.

feld 12y ago
You just increase the entropy by adding characters, numbers, etc and keeping it reasonably long (20+ chars). The entropy of my passwords is quite high according to Keepass.
- heinrich5991 12y ago
  The thing is, you can't determine "entropy" of a password after the creation. It's the creating process that determines how "random" your password is. KeePass's measure is just an approximation, and I have no idea about how accurate it is.

tedunangst 12y ago

Not that odd. All the words from Webster's are in web2, all the compound entries (not strictly "words") are in web2a. That said, "straight-fibered four-way cock" is my new favorite passphrase.

feld 12y ago
So that explains where they were sourced from. Thanks!

jrapdx3 12y ago

Using web2a is a great idea. I'd written a Diceware-like password generator in Scheme. The word word list was derived from the web2 list (FreeBSD /usr/share/dict directory). Even after paring it down to ~151000 items, the resulting passwords often contained arcane terms limiting password usability. With the web2a list slightly tweaked, I get many memorable passwords, e.g., "power-weaver-sand-screw-1081" or "cloud-ring-tea-fighting-1107". OTOH web2a is shorter (~76000 entries), giving 2 bits less entropy vs. using the filtered web2 list. Taking password readability into account, the higher rate of "keepers" with web2a probably evens out the difference. BTW the web2a word list is here (https://svnweb.freebsd.org/base/head/share/dict https://svnweb.freebsd.org/base/head/share/dict) in case anyone doesn't have access to it.