| 02:32.00 | *** join/#utah infobot (ibot@208.53.50.136) |
| 02:32.00 | *** topic/#utah is Utah-related discussion including user groups | logs @ http://infobot.rikers.org/%23utah/ | See also ##lds | To combat spam, you must register with NickServ if you wish to speak. This may or may not be temporary. |
| 02:32.00 | *** mode/#utah [+o infobot] by ChanServ |
| 03:04.52 | *** join/#utah tristanbob_WSU (~Tristan@2602:41:82d6:d300:eda4:d6e5:8ae2:e840) |
| 03:05.04 | *** join/#utah tristanrhodes__ (~tristanrh@2001:1948:212:1030:2440:f797:7706:ad17) |
| 03:09.23 | *** join/#utah tiwula (~lane@174-23-42-12.slkc.qwest.net) |
| 05:30.36 | klys | ~slashdot |
| 07:24.31 | *** join/#utah emcnabb (emcnabb@nat/redhat/x-byswshareyistwws) |
| 08:44.54 | *** join/#utah Jantz (~IceChat9@118-93-26-106.dsl.dyn.ihug.co.nz) |
| 12:39.12 | *** join/#utah aeryndunham_ (~aeryndunh@96.71.45.243) |
| 13:07.32 | *** join/#utah Jantz (~IceChat9@2407:7000:8d04:100:3cd8:7253:a17e:6c26) |
| 13:37.53 | *** join/#utah Jantz_ (~IceChat9@2407:7000:8d04:100:6556:6052:1461:bb6b) |
| 14:00.38 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 14:05.57 | *** join/#utah aeryndunham_ (~aeryndunh@96.71.45.252) |
| 14:37.35 | *** join/#utah ByronJohnson (~bairyn@unaffiliated/bob0) |
| 14:41.50 | *** join/#utah moccos (~moccos@104.243.62.132) |
| 14:49.00 | *** join/#utah aeryndunham (~aeryndunh@96.71.45.252) |
| 15:30.24 | *** join/#utah josephscott (~josephsco@192.0.123.2) |
| 16:04.50 | *** join/#utah emcnabb (emcnabb@nat/redhat/x-xweupxqzsscjgyrf) |
| 16:10.30 | *** join/#utah voldemor1ensen (~jmortense@98.202.131.37) |
| 19:40.53 | youtah | okay eightyeight I need your assistance |
| 19:41.17 | youtah | Looking at secure passphrases.... |
| 19:42.24 | youtah | I have passphrase 1 that consists of five, ~10 character, English words, no special characters, separated by spaces only. LOTS of entropy, correct? |
| 19:42.53 | BigBen212 | youtah: you've seen the xkcd about this, right? |
| 19:43.06 | youtah | yes |
| 19:43.21 | youtah | Now I have passphrase 2 that consists of ~20 random characters, which may or may not contain special characters, that mathematically has less entropy |
| 19:43.35 | eightyeight | youtah: depends on the set size |
| 19:43.38 | youtah | but because it doesn't have english words, is it more secure? |
| 19:43.46 | eightyeight | youtah: how big is the list of english words you're pulling from? |
| 19:43.58 | youtah | Some random English word database |
| 19:44.06 | eightyeight | i need a number |
| 19:44.11 | youtah | what does hashcat use? |
| 19:44.19 | eightyeight | whatever you give it |
| 19:44.53 | youtah | let |
| 19:44.58 | youtah | let's go with 170,000 |
| 19:45.07 | eightyeight | 170,000 unique words? |
| 19:45.10 | youtah | yes |
| 19:45.16 | eightyeight | what function is chosing the words? |
| 19:45.29 | youtah | lol, I have no idea... this is where I need your help |
| 19:45.31 | eightyeight | IE: how are the words being chosen? |
| 19:45.49 | spangborn | Randomly once |
| 19:45.54 | spangborn | and reused every time after |
| 19:45.54 | eightyeight | just picking the top 5 or last 5, or based on the current timestamp? or ... |
| 19:46.05 | youtah | lets say randomly once |
| 19:46.13 | spangborn | This is youtah's secure passphrase <-- |
| 19:46.19 | eightyeight | so a word can only be valid once, and never reused? |
| 19:46.27 | youtah | once in each position |
| 19:46.34 | youtah | Apple Orange Banana |
| 19:46.40 | youtah | Orange Banana Apple |
| 19:46.44 | youtah | Banana Apple Orange |
| 19:46.47 | youtah | for example |
| 19:46.47 | eightyeight | Apple Apple Orange ? |
| 19:46.47 | spangborn | starts tweeting from youtah's twitter account |
| 19:47.03 | eightyeight | IE: are dupes allowed? |
| 19:47.09 | youtah | spangborn how did you know my passphrase? I could only see *******'s |
| 19:47.19 | youtah | eightyeight, lets say yes in this example |
| 19:47.35 | eightyeight | ok. so "apple apple apple" is equally likely as "apple banana orange"? |
| 19:47.40 | youtah | correct |
| 19:47.42 | eightyeight | ok |
| 19:48.13 | eightyeight | then you have log_2(170,000) ~= 17.3 bits of entropy per word, assuming the function is uniformly random |
| 19:48.41 | eightyeight | so 5 words is approximately 86.88 bits of entropy |
| 19:48.58 | eightyeight | best practice is to be around 70 bits in my opinion |
| 19:49.09 | eightyeight | some disagree, and say 50 should be the lowest value |
| 19:49.20 | youtah | where as the random 20 character word would be how many bits of entropy? |
| 19:49.23 | eightyeight | personally, i don't think 70 is that big of a deal |
| 19:49.47 | eightyeight | 20*log2(170000) |
| 19:49.49 | youtah | random 20 char string* (not word) |
| 19:49.59 | eightyeight | oh |
| 19:50.09 | eightyeight | from how many characters? |
| 19:51.22 | youtah | a-z 0-9 and the standard special chars, mixed case... sooo 96? |
| 19:51.44 | eightyeight | all graphical ascii characters on a standard keyboard? |
| 19:51.50 | youtah | yeah, lets go with that |
| 19:51.58 | eightyeight | that's 94. 95 if you include the space. |
| 19:52.03 | eightyeight | 96 if you include the space and tab |
| 19:52.12 | youtah | 95 |
| 19:52.14 | eightyeight | (which are printable but not graphical) |
| 19:52.17 | youtah | lets exclude tab |
| 19:52.31 | BigBen212 | what do you have against the tab, youtah ? |
| 19:52.41 | BigBen212 | include space, but exclude tab, geez |
| 19:52.52 | youtah | I'm a tablist |
| 19:53.01 | youtah | Against Tablets? |
| 19:53.16 | eightyeight | and no restrictions on generation? |
| 19:53.26 | eightyeight | IE: must include at least 1 number and 1 uppercase and 1 special? |
| 19:53.30 | youtah | No restrictions |
| 19:53.38 | youtah | truly 100% random |
| 19:53.57 | eightyeight | ok. 20*log2(95) ~= 131.4 bits |
| 19:54.01 | youtah | unless it's Android, I'm okay with those Tablets. Not that dirty iOS. |
| 19:54.05 | youtah | Holy |
| 19:54.08 | youtah | well, shoot |
| 19:54.17 | youtah | looks like i need to get rid of my passphrases, lol |
| 19:54.42 | eightyeight | Entropy = Length * log(set_size) / log(2) |
| 19:55.05 | eightyeight | if a uniform random function is picking the results, and there are no restrictions |
| 19:55.55 | eightyeight | this is called "min-entropy" |
| 19:56.33 | eightyeight | https://en.wikipedia.org/wiki/Min-entropy |
| 19:56.42 | eightyeight | note- this is different from shannon entropy |
| 19:58.33 | eightyeight | also note- password crackers don't talk in terms of entropy. it gets their panties in a twist. instead, they talk rates and keyspace |
| 19:58.58 | eightyeight | IE: how many guesses per second can they make, and how far do they have to go? |
| 19:59.38 | eightyeight | "entropy" is something password generation designers use |
| 20:00.03 | eightyeight | i prefer entropy, because "a billion million thousand millenia" as a guess on successfully finding the password is stupid |
| 20:00.56 | eightyeight | but really, entropy = haystack and password = needle. so talking about entropy, keyspace, and rate is really all the same thing |
| 20:01.06 | youtah | right |
| 20:01.12 | eightyeight | you'll just get some pro password crackers twitching if you talk entropy |
| 20:01.24 | eightyeight | TL;DR- know your audience |
| 20:02.08 | youtah | lol |
| 20:03.17 | eightyeight | "oh yeah, my password is 1 of 170000^5. my rig can do 10 billion vanilla MD5 guesses per second. that's $TIME before i get 50% done, and odds are on my side" |
| 20:03.45 | eightyeight | vs |
| 20:04.41 | eightyeight | "my generator defaults to 70-bits of entropy for passwords. that's 11 base-95 passwords chosen randomly and uniformly" |
| 20:04.53 | eightyeight | s/passwords c/characters c/ |
| 20:05.13 | eightyeight | anyway |
| 20:05.14 | youtah | but at the same time, say a hacker was trying to find your passphrase, how long would it take to go through all 170k words, and then with a set of two words, and then three words, with various combinations such as spaces as separators, no separators, underscores as separators, etc.... to me at that point it seems like hashcat would fall and the words might as well be random chars at that time. |
| 20:05.41 | eightyeight | in practice, that's generally not how it's approached |
| 20:06.07 | youtah | more of a... here are a set of words that create this list of hashes...? |
| 20:06.11 | eightyeight | a password cracker will have prebuilt word lists, usually from previous dumps, that will probably knock out like 70% of the list |
| 20:06.26 | youtah | gotchya |
| 20:06.51 | eightyeight | then they'll do some hybrid changes, like "add a number at the end of each word" and cycle through all 10 digts |
| 20:06.56 | eightyeight | or append years after words |
| 20:07.01 | eightyeight | or append special characters |
| 20:07.17 | eightyeight | these hybrid attacks will pick up another 15-20% |
| 20:07.25 | frostyfrog | I'd think that they would mostly rely on the password dumps and the patterns contained within. |
| 20:07.26 | youtah | Password password password1! << to pick up stuff like this I assume |
| 20:07.50 | eightyeight | if the dump is particularly valuable, they may pay attention to cracked patterns |
| 20:08.08 | eightyeight | maybe the dump comes from a corporation with a policy like "must include at least 1 digit and 1 uppercase" |
| 20:08.22 | eightyeight | so they'll modify their attack to match that pattern |
| 20:08.40 | eightyeight | 95% of passwords in dumps are 10 characters or less |
| 20:09.08 | frostyfrog | and a fair chunk are used "everywhere" |
| 20:09.11 | eightyeight | and most serious hobbyist crackers can work through every 8 character base-95 password hashed with sha-1 in under a week |
| 20:09.19 | eightyeight | so the search is 9 and 10 character lengths |
| 20:10.16 | eightyeight | after all else fails, then they'll do incremental searches, like "build 3-word passphrases from a 170,000 word list" |
| 20:12.44 | eightyeight | good password generators should not let you generate 8 character passwords. ever. |
| 20:13.13 | eightyeight | 9 characters from base-95 should be the absolute, rock bottom, minimum |
| 20:13.56 | eightyeight | that's ~ 58-bits of entropy, and would require 95 weeks (2 years) for that previous dedicated hobbyist to 100% exhaust if hashed with vanilla SHA-1 |
| 20:15.01 | eightyeight | 8 characters = 1 week. 9 characters = 2 years. hmmm. |
| 20:16.04 | frostyfrog | Awww, I was going to point out your emoji one, but it's been removed. :/ |
| 20:16.11 | eightyeight | nay |
| 20:16.13 | eightyeight | it's there |
| 20:16.29 | eightyeight | in the "Random" box |
| 20:16.56 | eightyeight | colored in firefox, b/w otherwise |
| 20:18.13 | eightyeight | also, after just preaching on my soapbox, you'll notice the default 70-bits ef emoji entropy is 7 "characters" (really glyphs) |
| 20:18.16 | frostyfrog | I'm only seeing Coin Flips and Base-2 to Base-94 |
| 20:18.38 | eightyeight | it's there |
| 20:18.50 | eightyeight | are you running a local copy? |
| 20:19.20 | eightyeight | "DNA Sequence" is beneath "Coin Flips", and "Emoji" is beneath "DNA Sequence" |
| 20:20.07 | frostyfrog | Doh! I forgot that chromium doesn't render at all on the bottom half of that monitor >_< |
| 20:20.39 | eightyeight | anyway, there are 2248 unique emoji glyphs, and log2(2258) ~= 11.13 bits of entropy per glyph |
| 20:20.40 | frostyfrog | I was using the online version, it's there |
| 20:20.57 | eightyeight | so, 70 bit minimum is 7 "glyphs" |
| 20:21.13 | eightyeight | so the math is there, but only because 2248 >> 95. :) |
| 20:23.12 | eightyeight | here's a challenge for you: what is the length of "ððð¿ââï¸âµï¸ð©ð½ââï¸ðð»ð©ð¾ââï¸ð" ? |
| 20:52.21 | *** join/#utah BLZbubba (~mark@185.56.20.124) |
| 20:52.34 | *** join/#utah BLZbubba (~mark@185.56.20.124) |
| 20:53.08 | *** join/#utah BLZbubba (~mark@pdpc/supporter/professional/blzbubba) |
| 20:55.57 | jima | eightyeight: 112 bits |
| 20:56.10 | jima | unless we're supposed to include the "" |
| 20:56.29 | spangborn | shave and a haircut |
| 20:56.40 | spangborn | (That's two bits) |
| 20:57.00 | jima | steps on spangborn (not as funny but still funny) |
| 21:02.22 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 21:06.50 | eightyeight | jima: bzzt |
| 21:07.11 | klys | s1zz13 |
| 21:07.23 | jima | eightyeight: oh great, unicode or something? |
| 21:08.04 | eightyeight | indeed |
| 21:08.06 | eightyeight | emoji |
| 21:08.34 | eightyeight | $ printf 'ððð¿<200d>â<fe0f>âµ<fe0f>ð©ð½<200d>â<fe0f>ðð»ð©ð¾<200d>â<fe0f>ð' | wc -c |
| 21:08.35 | eightyeight | 73 |
| 21:08.38 | eightyeight | gah |
| 21:08.57 | eightyeight | anyway. 73 bytes. 21 characters. 7 glyphs. |
| 21:09.37 | jima | eww. didn't render on my xterm/screen/irssi. |
| 21:10.11 | jima | yeah, i should have pulled up my quassel |
| 21:10.22 | jima | although it doesn't show the .s |
| 21:13.04 | jima | (n/m, misparsed the printf line) |
| 21:13.34 | eightyeight | $ printf ððð¿ââï¸âµï¸ð©ð½ââï¸ðð»ð©ð¾ââï¸ð |
| 21:19.19 | v6jima | $ printf 𤪠|
| 21:37.59 | *** join/#utah Jantz (~IceChat9@2407:7000:8d04:100:31b4:e75b:d663:3d1) |
| 22:43.24 | youtah | spangborn, I heard the tune in my head when I read shave and a haircut |
| 22:44.04 | youtah | hey |
| 22:44.40 | youtah | so did you guys see what Trump determines as successful for the hurricane? |
| 22:45.27 | BigBen212 | that his hotels survive ? |
| 22:45.40 | youtah | Close |
| 22:45.51 | youtah | https://twitter.com/ChrisMurphyCT/status/1039614496002777088 |
| 22:45.56 | youtah | ^^ read |
| 22:47.09 | BigBen212 | well, in his defense, he still doesn't believe that as many people died in Puerto Rico |
| 22:47.51 | youtah | Do you think he knows where Puerto Rico is located? |
| 22:47.53 | BigBen212 | so you can declare anything a success if you just ignore all the facts |
| 22:47.59 | BigBen212 | he went there |
| 22:48.10 | BigBen212 | but that was thanks to his staff who got him there |
| 22:48.15 | BigBen212 | I doubt he could get there by himself :) |
| 22:48.24 | youtah | he just climbs in a magical fuselage |
| 22:48.31 | BigBen212 | haha, yeah |
| 23:02.00 | *** join/#utah fadein (~Erik@c-24-10-167-68.hsd1.ut.comcast.net) |