On St, 2015-02-25 at 22:54 -0700, Chris Murphy wrote:
On Wed, Feb 25, 2015 at 12:24 PM, Miloslav Trmač
<mitr(a)redhat.com> wrote:
>> If nobody else is looking at your screen, you can use one of the following
>> random passwords:
>> red mist
>> second wanted degree
>> however ready respect using
>> """
>
> Now this is an useful idea. We should have this. (The required never-ending
nowhere-leading discussion about what the recommendations should look like
notwithstanding.)
OK well at least there's acknowledgement, at least on this list, that
there need to be visible recommendations in the UI rather than the
user given a text fail whale. I don't know if there's consensus on
this point.
What about a "pronounceable" password creator, one that explicitly
doesn't use dictionary words? Based on the aforementioned 2009
estimated cost to brute force attack passwords, it still looks like
passwords like "however ready respect using" can't possibly be all
that safe against a voluminous attack. If you want to go to all this
work building such a thing and translating it, why not help the user
create completely non-dictionary passphrases that have some change of
being memorable by virtue of being pronounceable. Plus, the proposal
should be nonsense in any language, which seems less
Amero/Anglocentric.
anguleatimplesc
nitypeyrosentra
mideakeremicamo
spenhutendempis
And so on. I got these from Lastpass which lets me choose 'make
pronounceable' as an advanced option, and I can pick any length. The
argument against is that chances are the user has to write these down
at least temporarily until memorized. *shrug* But that could be true
for four word passphrases too.
Note that there is already pronounceable password generator in the
libpwquality library. You can test it with the pwmake command. The
generated passwords contain also some numbers and special characters so
that they can be shorter with the same entropy. The lowest entropy
passwords that are possible to generate have 56 bits which might be a
little bit too much though for cases where online attacks are
rate-limited.
Examples:
owt4NYt=AtYg
uj-iMuhIh5Im
HYk@qziL4fmE
aHaRiP=yccUp
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
(You'll never know whether the road is wrong though.)