News for hackers. Stuff that matters.

A comment on New 25 GPU Monster Devours Passwords In Seconds. Parent comment

Re:New 25 GPU Monster Devours Passwords In Seconds by sspiff on Wednesday December 05, 2012 @04:37AM (#4875583)
Since reading that xkcd, I use phrases as passwords, using a simple Ruby script to generate them:

  w = File.readlines('/usr/share/dict/words').map { |w| w.chomp }.reject { |w| w !~ /^[A-Za-z]+$/ }; 3.times { print w[rand * w.size] }; puts
I generally get an easy to remember password after about 3 tries. The biggest issue I have with this is typing in passwords on mobile devices.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by trebor on Wednesday December 05, 2012 @10:36AM (#4876676)
A slight refactoring for Ruby 1.9.3 users, uses Array#sample to grab 3 random words, etc.

    ruby -e 'w = File.readlines("/usr/share/dict/words").map { |w| w.chomp }.reject { |w| w !~ /^[A-Za-z]+$/ }; puts w.sample(3).join(" ").downcase'
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by _ikke_ on Wednesday December 05, 2012 @04:47AM (#4875609)
Aren't phrases easier to type on mobile devices than letter / number combinations? I always find it annoying to have to switch to different keyboard modes (text / numbers), or having to hold the letter / number key for a few seconds.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by sspiff on Wednesday December 05, 2012 @05:23AM (#4875675)
Sure, the simple characters make it a bit easier, but the phrases tend to be much longer.

The error rate on a touchscreen keyboard is high enough to really become a problem at 20+ characters when you only see the last typed character (no password review).

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by Karunamon on Wednesday December 05, 2012 @09:43AM (#4876412)
Using dictionary words makes it easy for more modern predictive keyboards to keep up, though. Taking the XKCD canonical example, "correct horse battery staple", it's a reasonably secure and lengthy password and includes special characters.

It could also be keyed in via something like Swype or SlideIT in almost as fast as it could be keyed in on a computer keyboard.

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by sspiff on Wednesday December 05, 2012 @10:18AM (#4876581)
Perhaps, depending on the user. Doesn't work well for me though.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by rootbear on Wednesday December 05, 2012 @09:03AM (#4876253)
Yeah, the iPhone keyboard is what finally got me to stop using r2d2 or c3p0 as a part of my password. And the fact that they are probably in the cracking dictionaries.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by CodesInChaos on Friday December 07, 2012 @10:05AM (#4887165)
Is `rand` a secure random number in ruby? In many programming languages/implementations the default PRNG is only seeded with the current time, which leads to quite low entropy.
[ Parent | on HN ]