Hacker News Reader

Comment by taeric | Hacker News Reader

I was expecting something that would focus on the rules that so many sites impose. Length is easy, but many have silly rules where certain characters are not allowed.

Then there is the side of making a password that is easy to type on a phone. Ideally, I want a hard password that doesn't require me to change input mode on my phone too many times.

Well, ideally, I'd rather I could just use my security token everywhere... But that is a separate problem.

View on HN

I have been thinking about that. How would one do that with a minimal impact on password security? Character sets are easy, but one could set some arbitrary limits on character frequency. I would probably generate a shitload of passwords and filter them based on the rules since that would mean not having to have complicated logic for password generation and thus not accidentally generating passwords that are less secure than the rule limitations.

I made this: https://pastebin.com/kQhKexEd in 5 minutes. It is however slightly off with the random distribution since I am only doing a simple remainder.

    (let ((byte (remainder (get-u8 urandom) size)))

is skewed if size isn't a power of 2. What you should do is mod by the next-largest power of 2 (e.g. if size is 82, mod by 128). Then if the result is in-range use it, otherwise discard and reroll.

I just edited the comment before I saw your answer. I realised my mistake and wanted to sink through the earth. Everyone has brain farts, I guess.

What I ended up doing was limiting the charset size to 256 a maximum of characters, and then discarding any value that is larger than the current charset.

I still think that the best approach to password requirements was the one used at Nortel. They ran a password hash cracking algorithm continuously on the PW database, and when they cracked yours you had to change it. Other than that there were no complexity requirements or mandatory change intervals. If you had a good complex password you got to keep it for a long time, and if you set '12345', 1 minute later you'd have to change it.

That is super cool. Is there any reading material on this somewhere?

I heard this anecdotally from a long time colleague of mine who worked there. I don't know of any more solid reference to give, sorry.

Reply on news.ycombinator.com