Hacker News Reader

Comment by EricBurnett | Hacker News Reader

as in 10^6 possibilities, ignoring backgrounds? For the curious, that means collisions are expected >50% of the time with ~1200 samples, and someone could easily generate collisions on purpose with little effort.

So it works well for a simple signal (which is the goal), but shouldn't be relied on if people might try to abuse it.

View on HN

If you use all three sets (?set=any), plus backgrounds, that adds two additional choices, which brings us into the 100+ Million category. As a signal to review the Pubkey, that's probably enough.

I could have made up more Random elements, but that'd take more time/money, which isn't worth it unless anyone outside of me actually wants it ;)

It seems like it would give you a false sense of security. You have to think about it in terms of "could an attacker who can spend $1000/hr brute force a duplicate pub/priv key combination that generates the same robot.

I wonder if you could get better results using a markov chain to generate english prose from a large sample. If you take the top N next word options, and select one based on the next log_2(N) bits of your hash/key, you lose no key space and should get a nonsensical but perhaps easily remembered string.

Sounds like it would be a pretty good "did I type my password correctly?" indicator.

Lotus Notes has one of those with a set of keys. I recall that the first couple of times it was weird -- then it seemed to make sense. What is really weird though -- it puts in additional XX characters when you typed out your password. So type out "pass" and it might display "XXXXXXX" Which I guess is effective for preventing over-the-shoulder information leakage but weird all the same.

You might be interested in Chroma Hash for that sort of purpose: http://mattt.github.com/Chroma-Hash/

woudn't you need to be sending the password over to the robot icon people to get the imag?

Reply on news.ycombinator.com