Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You might as well use the full length haiku - you wouldn't be exposing it to an external service, you wouldn't need internet access or a program installed, and you can probably type it faster than the IPv6 address. Using dictionary words for a passphrase is actually fine as long as the phrase is long enough. Figure out how much security you need (128 bits if you're going with the IPv6 example).


The problem with using the whole haikus, is that you must type quite a lot, typically blindly, into a password entry field -- and not make a single mistake.

I think the more interesting question is: if you manage to memorize the haiku -- will you be able to retain it longer than the ipv6 address? After typing in the address a few times a day, you'd have it memorized (at least in muscle memory). But what if this was something you either used rarely (passphrase for restoring backups for example). Would you remember the haiku even after you'd forgot the ipv6 address?


If you memorize poems at all you have to remember the exact words; IMO they're easier than memorizing numbers. (In fact, the way I can remember the first 50-or-so digits of pi is that someone wrote a poem where the word-lengths correspond to the digits).


It's not that it's hard to remember, it's hard to type in. At least that's my experience (I use a few 16+ character passwords/passphrases). It might be easier if it's all lower-case, no numbers etc -- I'm not sure -- I've not tested myself.

But in writing the above, I had to hit backspace at least once -- something that's a bit hard to catch when you're typing blind into a password entry field, like when typing in the pass-phrase for unlocking a LUKS partition, or logging into a console session. Or even typing in a login password in a graphical login manager, like the windows login prompt, or gdm/ldm/xdm etc.

And it also takes time. Especially if you only get it right on your third attempt.


Shrug; I find it much easier to write English words than numbers and the like, but I guess YMMV. If you don't realize when you've made a mistake, it's well worth spending a bit of time learning to type properly, IMO; I spent a weekend practising and while I still occasionally typo, I know when I have without having to check. E.g. I wrote this sentence with a couple of letter transpositions, backspaced and corrected them, all without looking at the screen, just to check that it was possible.


Maybe. Then there is typing in the passphrase on Android [ed: ie using an on screen keyboard] to unlock the FDE etc. Fwiw I had a year of touch in junior high, so I do generally type pretty well - but I still end up having to type in my pw to unlock my computer a couple of times on average. I'm not sure which parts I miss - quite possibly I'd be better off with a slightly longer, all lowercase pw.


If you take full disk encryption with Truecrypt, the max length of your password is limited to 64 char.

If you use a pass phrase it will be easier to crack with a dictionary attack since at best you will put about 15 words in 64 chars.


How long's the actual Truecrypt key? Ordinary conversational English has about 3 bits of entropy per character, so 64 characters will have an equivalent strength to a 192-bit key. If Truecrypt uses 128-bit keys that's plenty; if they use 256-bit keys, they ought to allow a longer passphrase.

Of course if you choose truly random characters you have 7 bits of entropy per character, so you would have the same strength with a 28-character password. But which is going to be easier to remember, 28 random characters or 64 characters of ordinary English?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: