Hacker News Reader

Comment by iamnothere | Hacker News Reader

Never use a website to generate a password for something important like this. You can print out diceware passwords and roll dice.

View on HN

> You can print out diceware passwords and roll dice.

Or on the CLI:

* https://packages.debian.org/search?keywords=diceware

* https://packages.debian.org/search?keywords=pwgen

You can just take a picture of a pile of dice, a pile of rice, or a tree, patch of grass, etc, and compute a secure hash/whatever and base six it to get the rolls.

I actually have a lava lamp next to my desk for this reason. Snap a photo, compute a hash!

Count the bubbels with your fingers while you count from 0 to 9. Every x fingers you write down the number.

Extra points if you hold you face really close and count in a dead language. You can also make ordered hand gestures in stead of counting on your fingers. Be a wizard about it!

Yer a cryptographer, Harry!

Are you saying to take a hash of a picture and convert that to base 6 for your dice rolls to plug into a word list for creating a passphrase?

Is that actually better (in practice, not in terms of entropy) than /dev/urandom? I have a lot less trust in my ability to successfully scrub a picture from my phone that deterministically created my passphrase.

> Is that actually better (in practice, not in terms of entropy) than /dev/urandom?

It offers protection in the event that your /dev/urandom is compromised. Otherwise no.

(Of course, if your /dev/urandom is compromised then whatever process you use to compute a hash of a photo is likely compromised as well.)

If you're concerned about that, you can concat your JPEG with a few bytes from /dev/random and you'll get the security of whichever is stronger. In practice none of this will be your weakest link.

It is possible that using a JPEG with its known bytes could make the final effort weaker than if you just used /dev/random.

No, that would fundamentally break the way (good) hashing works if I could add known data and get it to reveal the secret data

If you have a computer do something you cant know if it really did what you wanted.

you can play a round of scrabble and build the passphrase out of that

The entropy wouldn’t be very good compared to repeated dice rolls.

Reply on news.ycombinator.com