Hacker News Reader

Comment by bartvk | Hacker News Reader

There are a number of such generators, but this one has good defaults (with the number at the end).

IMHO, it would be better if it would generate a list of passwords, so if the site is malicious, it wouldn't know which one you picked. It's weak, I know... But for this reason, I like this one: https://xkpasswd.net/s/

View on HN

There's no way people actually use random websites to generate their passwords, right? Like, I can't just post or comment a password generator to a reasonably-tech-savvy forum like HN and have people actually use it to generate their next email password, can I? Surely there's at least some communal wisdom about how to correctly obtain software that you can reasonably trust with such an important task?

This is a fun project, and I respect implementing anything birthed from XKCD, but I agree and don't think I'd use this sort of thing to generate my passwords. ( Or I'll just stick to Password123 )

Unless the list is long enough for the selection process to have enough entropy to make an at least halfway decent password, that's pointless. And if it is, good luck downloading the list.

Why? Supposing 600,000 English words with an average length of ten letters that just around 6 megs uncompressed.

A password space of 600,000 options is under 20 bits of entropy. That's basically pointless. If you want 40 bits, you're going to need a little over 1,000,000,000,000.

Sure, but I thought it was obvious you wouldn't use one word. I'm saying a six megabyte file plus a one line shell script is enough to generate secure passwords with just four words by producing something like "Gargantuan Lackadaisical Lugubrious Flibbertigibbet" which while a bit of a mouthful isn't terribly difficult to memorize compared to 76 bits of line noise or even base64.

But that's not what was being discussed. Someone suggested that if one were to use a website that generates passwords, they should use one that generates multiple passwords to pick from to mitigate the risk of the site being malicious and knowing your password. And I'm saying that that is not useful for any practical length of password candidate list.

Reply on news.ycombinator.com