Hacker News Reader

The unix utility apg has some nice functions for generating passwords. Particularly I like it's "pronounceable" algorithm which tries to generate passwords that are slightly pronounceable. It's a good way to get those 6-14 character passwords with numbers, upper case, and punctuation that are easier to remember but still random.

    WeampE6quaph (Weamp-E-SIX-quaph)
    2hoov2Klypfo (TWO-hoov-TWO-Klyp-fo)
    GicutOj8 (Gic-ut-Oj-EIGHT)
    HegEmWydwev5 (Heg-Em-Wyd-wev-FIVE)
    Tegdijetyik4 (Teg-dij-et-yik-FOUR)
    Fon7ochry (Fon-SEVEN-och-ry)

I usually take the password and type it about 100 times to see how it feels, subtly changing any characters that feel awkward to type. This gives me a password that is very fast and natural to type (less likely to have errors), but still has a lot of randomness and obeys all the stupid password rules.

That's only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don't know how long it would take to create a rainbow table for the whole space, which is this big:

  72940^4 = 2.8304992 × 10^19

To put it in perspective, a 14-character password using only lower case English alphabet letters as individual tokens already beats this:

  26^14 = 6.45099747 × 10^19

Then again, a random string of 14-characters is nearly impossible to remember.

The key takeaway here is that every word adds another 16.15 bits (assuming good random source and no non-random decisions by the user), whereas another character adds only 4.7 bits. I'd argue that the effort to remember another 4 random characters (to reach those 16 bits) is far more than the one to remember another random word. We're quite good with words, you know :)

yes, but picking a handful of random words out of the dictionary is not the advice the passphrase advocates are giving. They are saying use a phrase that's meaningful to you and easy to remember.... which means most people are going to use a phrase in their native tongue, just like most people are using passwords like "mylinkedin!" for linked in.

Edit: also, for anyone wanting something like the above technique, I recommend Diceware.

> "They are saying use a phrase that's meaningful to you"

I haven't seen any passphrase advocates say that.

The ones I've seen all say "use 4-5 random dictionary words". Come up with a meaning for the phrase, and it'll be easy to remember.

Why blacklist rather than whitelist?

    LC_ALL=C egrep '^[[:lower:]]{4,8}$' /usr/share/dict/words |
    shuf --random-source=/dev/random -n4 |
    fmt

That's picking from ~35,000 words, which I think is still good enough but avoids ending up with "interpreters incredibility disciplinary constitutionality". (I need the C locale to stop this old GNU grep being painfully slow.)

It should be noted that if you use the same passphrase for your most important things, then it may not matter how uncrackable it is -- if it gets compromised through a method other than cracking, then all your other important accounts are also compromised.

Even relatively high-stakes companies like banks and credit card companies make obscenely stupid mistakes when it comes to security. For example, there was a case fairly recently where you could log into your Citibank account and change the account number in the GET query string, and you'd instantly have access to anybody else's account. Given that they're capable of that type of idiocy, all it takes is for one mental giant to decide that encrypting your password is better than hashing it, and you're vulnerable.

Malicious behavior isn't the only thing to watch out for. By doing business with the outside world, we're putting ourselves at the mercy of complete morons every day. If you use a different passphrase for every account, then you can at least limit your risk to one service.

Cool! You don't need to use cat, though:

  egrep -v "é|'s$|[Åå]|[Øø]" /usr/share/dict/words|shuf --random-source=/dev/random -n4

UUOC. It even has its own several web pages. Start there:

http://en.wikipedia.org/wiki/Cat_%28Unix%29#Useless_use_of_c...

To generate random alphanumeric strings drop the following into your zshrc:

  function mkpw () {
      if (( $# == 0 )) then
          head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-12}
      else
          head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-$1}
      fi
  }

By default it generates an alphanumeric string of length 12. Given an integer argument n it generates an alphanumeric string of length n.

Why the test of both $# and $1?

    tr -dc '!-~' </dev/urandom | head -c ${1-12}; echo

Change to A-Za-z0-9, etc., to suit.

Mostly because I'm terrible at shell scripting. Thanks.

  massage beef Concords recliners

Damn you.