News for hackers. Stuff that matters.

A comment on Passphrases You Can Memorize That Even the NSA Can’t Guess.

Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by feld on Friday March 27, 2015 @01:02PM (#9277524)
FreeBSD has an odd dictionary file (/usr/share/dict/web2a) which has short phrases. I use a script to randomly pull some entries from it and then I piece memorable ones together to make my passphrase. Sprinkle in some punctuation and character replacement and it makes great passwords that are easy to remember.

  % ./passphrase.pl 10
  coppice-topped
  belly-naked
  bastard locust tree
  diamond bort
  middle-aged
  self-mapped
  air level
  field gun
  machine rifle
  chock stone
  % ./passphrase.pl 10
  self-knowing
  soul-killing
  Magna charta
  fly-killing
  spring chicken
  blotting book
  finger-cone
  gauge glass
  Fort union
  assistant examiner
  % ./passphrase.pl 10
  soya-bean oil
  foxtail pine
  island-dotted
  four-way cock
  side-bar rule
  benzoyl hydride
  straight-fibered
  steel town
  stone bramble
  rag-boiling
[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by tedunangst on Friday March 27, 2015 @01:44PM (#9277849)
Not that odd. All the words from Webster's are in web2, all the compound entries (not strictly "words") are in web2a.

That said, "straight-fibered four-way cock" is my new favorite passphrase.

[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by feld on Friday March 27, 2015 @07:33PM (#9279727)
So that explains where they were sourced from. Thanks!
[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by TheLoneWolfling on Friday March 27, 2015 @01:10PM (#9277585)
Be careful that your "memorability" pruning doesn't reduce the entropy too much.
[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by feld on Friday March 27, 2015 @01:14PM (#9277616)
You just increase the entropy by adding characters, numbers, etc and keeping it reasonably long (20+ chars). The entropy of my passwords is quite high according to Keepass.
[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by heinrich5991 on Friday March 27, 2015 @01:32PM (#9277765)
The thing is, you can't determine "entropy" of a password after the creation. It's the creating process that determines how "random" your password is. KeePass's measure is just an approximation, and I have no idea about how accurate it is.
[ Parent | on HN ]
Re:Passphrases You Can Memorize That Even the NSA Can’t Guess by jrapdx3 on Saturday March 28, 2015 @12:34AM (#9280528)
Using web2a is a great idea. I'd written a Diceware-like password generator in Scheme. The word word list was derived from the web2 list (FreeBSD /usr/share/dict directory). Even after paring it down to ~151000 items, the resulting passwords often contained arcane terms limiting password usability.

With the web2a list slightly tweaked, I get many memorable passwords, e.g., "power-weaver-sand-screw-1081" or "cloud-ring-tea-fighting-1107". OTOH web2a is shorter (~76000 entries), giving 2 bits less entropy vs. using the filtered web2 list. Taking password readability into account, the higher rate of "keepers" with web2a probably evens out the difference.

BTW the web2a word list is here (https://svnweb.freebsd.org/base/head/share/dict) in case anyone doesn't have access to it.

[ Parent | on HN ]