Xkcd Password Generator

I kind of feel like all these passwords schemes and discussions about password strength fundamentally miss the point. Password reuse is the single greatest threat that any user faces. Nobody's going to guess your gmail password, even if its just six random lowercase letters. They're going to get it from a database dump of a compromised site where you reused that password.

I have well over a hundred websites listed in my password manager. There is not a chance that I could remember a unique password for every one of them, no matter how easy they were.

Neat, I have the following in my `.bashrc` to accomplish pretty much the same thing. It should be noted that I do not use it for passwords (I have a password safe for that), but I do use it for passphrases since I may have to read them over the phone.

    secret () {
        # '\u' for `sed` is a GNU extension.
        shuf /usr/share/dict/words \
            | grep '^[A-Za-z]\+$' \
            | head -n 3 \
            | sed -e 's|\(.\)\(.*\)|\u\1\2|g' \
            | tr -d '\n' \
            | sed -e 's|$|\n|g'
    }

    > for _ in `seq 7`; do secret; done
    InterweaveMakariosEncrusting
    DisseminatingAgriculturalistCautioned
    EffectuatingCobblersEgos
    AccidentalKopeckRevolts
    RefDivansUndersigns
    SalesmanSubmitterFlak
    TempsIlluminedQuickening

Ever since reading that xkcd comic and learning about diceware, I've really wanted to create a password generator that could spin out complete diceware sentences of arbitrary length. (Markov chains?) Mnemonics of various kinds could be taken into consideration: rhymes, onomatopoeia, etc. Instead of a 4-word nonsense passphrase, you'd get something like "the red rancid raccoon bit into the butter bucket biscuit" — easy to remember and secure. Unfortunately, I'm not too familiar with this subset of programming.

(Limiting the word pool of each slot due to mnemonics would complicate the entropy calculation, but it should still be fairly straightforward.)

The most important thing I realized when it comes to passwords was the classification into 2 types: strong passwords (keys, local login, local encryption, master passwords for password managers) which is best generated using the Xkcd method, and then the less obvious disposable passwords (all non-local usage, i.e. websites and other temporary need). For the later, I use SuperGenPass[1]. It ensures that 1) my passwords are not reused across sites and 2) they are strong without the need to remember them directly. Because SGP uses hashes, it is very easy to add counters to existing passwords/secret phrases and create a brand new password without much mental effort. I've outlined such a procedure in the issues[2]. Using counters in the "secret" field, I will probably never ever need to change my master passphrase.

I won't deny though that for mobile use, it's a bit cumbersome. The Android app is fine and free[3], and iOS app is a buck[4]. And overall it's a pain if you must login to sites frequently (ideally, using a native app reduces this greatly, login once until you manually logout).

It's also pretty confusing for non-technical people to get behind. I actually sent out an entire email blast to friends and family giving them my best attempt at an explanation, argument, and tutorial of how to use it. I don't think anyone did it.

So while the interface is kind of clumsy, the strategy is solid and I love knowing that I can use it.

[1]: http://www.supergenpass.com

[2]: https://github.com/chriszarate/supergenpass/issues/40#issuec...

[3]: https://play.google.com/store/apps/details?id=info.staticfre...

[4]: https://itunes.apple.com/us/app/supergenpass/id451606360?mt=...

instead of remembering passwords i remember only one function i've been using for many years which takes the name of the site as an argument and returns the password as the result.

I just use Diceware: https://qrmn.uk/dwr/

(With thanks to Alyssa Rowan for the CSPRNG design. Public domain - feel free to copy it.)

For really important stuff, actual dice just to make sure.

Two years ago I wrote about why this type of password is no longer safe: https://medium.com/@hnlean/imp3n3tr-ble5832-not-an-impenetra...

(See step #6 in the list of steps in the article)

I'm sure the situation has only got worse since then.