StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>I've generated human-friendly checksums by taking bits from an MD5 checksum and using them into index into a list of words. For example:</p> <pre><code>: nr@yorkie 7012 ; md5words /home/nr/.profile overextend moonscape cucumbers outsmarting </code></pre> <p>The code is about 40 lines of Lua not counting the word list, which is included in the script so as to produce identical results on every system.</p> <hr> <p>EDIT:</p> <p>In your application, you want to generate 50,000 keys. You can do it by something like this:</p> <pre><code>for ((i=1; i<=50000; i++)) do echo "this is my secret phrase $i" | md5words done </code></pre> <p>Using this procedure with a different secret phrase produces these keys:</p> <pre><code>Chisinau Phaethon customs Martina commensurate freewill logical cambered kamikazes Creighton Dobro's Alonzo medallion's jesters goofy keystones Anaxagoras martial Medina's Hon's acclimatized chirping Cleopatra's mascaras buoyant nuclear lumbering disagreements dampens Philby cloak drollness </code></pre> <p>These keys are difficult to forge: the word list has almost 100,000 words on it, so there are 10^20 possible 4-word sequences. If you have 100,000 codes, the chance of somebody being able to guess a code at random are one in 10^15. If you put a throttle on the number of keys people are allowed to try, say one key every 0.3 seconds, you won't have a problem.</p> <p>If I were deploying this idea in your application, I would prune the word list to something shorter, maybe only 10,000 words that are very commonly recognized. Even after losing a factor of 10^4 the numbers are vastly in your favor---the chance of guessing a key would be 1 in 100 billion.</p> <hr> <p><strong>UPDATE</strong>: In August 2011 this technique was the subject of an <a href="http://xkcd.com/936/" rel="nofollow noreferrer">xkcd cartoon</a>.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload