Hacker News Reader

Comment by mason240 | Hacker News Reader

This would actually be very useful for my Google and LastPass password. I have everything else in my LastPass manager, but it is always trying to get into my google account from different places is difficult, so I have a rememberable password for both.

This would let me keep a much more secure password for both.

View on HN

Just use random words. Memorable passwords don’t have to be weak. Five random common english words are already very strong. Just make sure you don’t pick the words by hand.

https://github.com/resonantcore/lib/blob/master/js/diceware/...

https://github.com/resonantcore/lib/blob/master/demo/dicewar...

Run this locally, e.g.

    dw = new Diceware();
    dw.load("https://raw.githubusercontent.com/resonantcore/lib/master/js/diceware/diceware.wordlist.asc", function() {
        console.log("Diceware loaded!");
    });

    console.log(dw.getWords(8).join(' '));

If you're on linux you can usually just do:

    shuf -n 5 /usr/share/dict/words

On Mac OS X you need coreutils for shuf, which you can get from brew (it's called gshuf once installed).

To get rid of the newlines

    shuf -n 4 /usr/share/dict/words | xargs | sed 's/ //g'

Or slightly more simply:

    echo `shuf -n 5 /usr/share/dict/words`

Maybe add this to your .bashrc file?

    randword()
    {
      if [ -z $1 ]; then
        echo `shuf --random-source=/dev/urandom -n 5 /usr/share/dict/words`
      else
        echo `shuf --random-source=/dev/urandom -n $1 /usr/share/dict/words`
      fi
    }

Test output:

    kobra@stormforge blah $ randword 4
    crackpots fragmentation maximally Bradly's
    kobra@stormforge blah $ randword 6
    turnover's nonproliferation's bestowal's sulkier hillbilly Narmada
    kobra@stormforge blah $ randword
    Marciano fibulas roadwork mobilizations organics
    kobra@stormforge blah $ randword
    coins bronzed housemother's forefather supposing

I would be very cautious about using shuf for password generation, since it doesn't use a cryptographically-secure random number generator (I just checked the source).

Edit: I see that shuf permits the use of custom seeds, so you can do the following, and it will be secure:

    shuf -n 5 --random-source=/dev/urandom /usr/share/dict/words

Or:

  python -c 'import random;w=open("/usr/share/dict/words").readlines();print " ".join([random.choice(w).strip() for _ in range(5)])'

You can use https://www.fusionbox.com/mouseware/ to do this

Except this has stopped being strong a while ago, since it has been popularized by xkcd in 2011 cracker have incorporated this scheme in their password cracking routines.

Bruce Schneier blogged about this last year: https://www.schneier.com/blog/archives/2014/03/choosing_secu...

Except Schneier is just plain wrong about this. The numbers presented in XKCD comic were already assuming that the attacker has full knowledge about how the passwords are generated, including the wordlist used. This has been discussed over and over in various places, including HN. Long story short, there is no shortcuts for attacker against true random bits of entropy.

Reply on news.ycombinator.com