Hacker News Reader

Comment by tomxor | Hacker News Reader

Promoting diceware is admirable, but I don't like the idea of trusting a remote website generator.

A local diceware generator is probably available in your package manager, e.g:

  sudo apt install diceware

  diceware -n 6

  QuickenPrisonThermosDefilingBasicsVengeful

View on HN

Diceware is supposed to be done with Dice in an entirely offline manner. I guess a local program is still useful, but in theory the program could be a shoddy RNG with non-random passwords. The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself.

For all of its faults, 5x six-sided dice looking up this wordlist (https://theworld.com/~reinhold/diceware.wordlist.asc) is something that can be accomplished by hand, without computer assistance.

Assuming you have trustworthy dice (they don't have to be perfectly balanced, just something you can trust to be random), then you can diceware your own password by hand.

> The program shouldn't be trusted unless you wrote it yourself, or otherwise performed a security audit yourself.

I'm just a humble non-crytographic-programmer making practical suggestions with the most substantial security improvement for the least effort... Of course personally - I roll dice, dice that I whittled out of sticks, sticks from different trees that I collected from different parks, parks that I visited in a random order based on the results of a PRNG of my own secret design, a PRNG I built out of swarm crab based logic gates on a secret beach, seeded with a number collected from a geiger counter and small sample of u238, a geiger counter I constructed from photodiodes and aluminium foil, photodiodes I fabricated out of mud, rocks and fire. One day I hope to finish implementing my own general purpose computer and browser, then I will finally be able to use my passwords :)

Well, there's questions like why use 6^5 (46656) words if you're just not going to be rolling six-sided dice? There are other wordlists and dictionaries out there.

For example, randomly selecting words from the Basic English Wordlist (https://simple.wikipedia.org/wiki/Wikipedia:Basic_English_co...), a list of 2626 words, could be a better methodology.

I feel like having words like "eee" and "eeee" or "g's" and "gs" on the list sort of defeats the point of "correct horse battery staple" - that the words are easily memorable and non ambiguous.

EEF’s is better.

https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

https://pypi.org/project/xkcdpass/ this uses eff-long as the default (but also has other lists). It's available over pip and/or through most distro package managers.

I don't like the original diceware list. The EFF made a pretty good list though: https://www.eff.org/dice

Well, you only need one six-sided die really. It's really fun to do as well. I highly recommend the EFF wordlist though.

Or could just do something like this:

    cat /usr/share/dict/words | shuf | head -n 4

on debian, 'sudo apt install pwgen'

pwgen with the -s option will generate 'random' passwords, up to the randomness limit of whatever random source is provided by your kernel and system.

https://packages.debian.org/search?keywords=pwgen

Reply on news.ycombinator.com