Box Relatives

Update 7/6/2011 — Mirroring this site is not only allowed, but encouraged!  If you’re interested, grab the javascript and the code and post it on your site. I’d love it if you would post a comment here if you do so.

In recent weeks I’ve gotten increasingly worried about my passwords, what with all the hacking that has been going on. I was a serial password re-user and now I realize that this was a mistake. I’ve started using a password manager for Firefox at home, but this isn’t an ideal solution, as my passwords are only on my home computer. I was discussing this with some colleagues at work and thought the following might be the best solution: for each website simply take the first few (say 5) characters of the name of the site, then concatenate that with a key phrase (perhaps the password you’ve been reusing). Then create a hash of the result and take the first few (say 12) characters. Thanks to this site, I’ve embedded a SHA-256 hash generator below. Don’t worry — it only uses javascript so no information you type will be passed to my server.

Let me give some examples here so it’s clear what’s going on. Say you’ve been using the ultra-insecure password “MyPassword” for gmail, paypal, and ebay, but now you want something more secure. Using the method detailed above, you would take the three strings “gmailMyPassword”, “paypalMyPassword” and “ebayMyPassword” and feed them into the generator above to get the three much more secure passwords “f8809f148b90”, “04b1bbe378d3”, and “691b2660c9e2”. You can then save them in a Firefox password manager for everyday use, and if you are at a new computer and need the passwords, you can come back to this page to retrieve them.

Now, this system isn’t perfect. Some sites will require you to have at least one uppercase letter — in that case I recommend changing the first letter in the generated password to uppercase (e.g. 691b2660c9e2 -> 691B2660c9e2). Some sites may require you to not start your password with a numeral, which is stupid, so you shouldn’t be on any of those sites (kidding! … though I don’t know how you would adapt this to that situation — Update: maybe pick a letter to add to the beginning in those situations?) And in case you are worried that this page may not be here forever, don’t worry — there are plenty of other SHA-256 hash generators online; you’ll just have to truncate to the first 12 characters manually.

Notes and updates:

• Out of an overabundance of caution, you may not want to generate passwords in exactly the way I’ve described. Consider forming your strings like MyPasswordgmail, MyPassword@gmail, MyPassword!gmail, MyPasgmailsword, gmail.com-MyPassword, etc.
• Yes, there are other sites that do something similar. But I would be worried that if those sites disappear, you would be left without a way to recover your original passwords. This process is simpler, only relying on the SHA-256 algorithm, which, as mentioned above, is popular and has many implementations.
• I’ve re-posted this on Blogger so that in case I fail to pay for my web hosting, at least this service will remain active so long as I don’t violate Google’s terms of service or anything.
• I’ve added an “advanced” method that does the following: it passes your string through the SHA-256 hash function as before, but then converts that output to a Base64 encoding, removes any ‘+’ or ‘/’ in the result, and gives you the first 12 characters of the output. This will give passwords with more characters, but is not as easily reproduced without this site.
• 7/6/2011 — All right, I’ve added two more modes that rely on the popular MD5 hash, as opposed to SHA-256.  I may add more at some point as well.

Perl, I’m leaving you.

I changed my GMail status to this today and I thought I would give a few words about why. I wanted to go through my Scrabble word list to find five-letter words in which the 3rd and 4th letters were the same, and which became new words when read backward. At first I modified a stock perl script of mine to do it, and then I wondered how easy it would be in Python. So I took a few minutes and came up with this:

#!/usr/bin/python

fid = open('scrabble.txt','r')
dict = [x.rstrip('\r\n') for x in fid.readlines()]
fid.close()
mywords = [x for x in dict if len(x) == 5 and \
x[2] == x[3] and x[::-1] in dict]
print mywords

(Edited to fix a minor error)

How awesome is that? Look at how short, clean, and readable it is! The only slightly tricky part is the

x[::-1]

bit that reverses the string x. So from now on, all my (new) scripting will be in Python. This includes, by the way, the Roman numeral clue page that’s just gone up. So there’s that, too.

Update: here’s Joon’s perl code to do the same thing.

#!/usr/bin/perl
use strict;

my %dict;
open DICT, "scrabble.txt";
while (<DICT>) { chomp; $dict{$_} = 1; }
close DICT;
for (sort keys %dict) { print "$_\n" if (/^..(.)\1.$/ && $dict{reverse($_)}); }

All right, looks like I’m kicking off this blog with a complaint.  This does not bode well for the future.  Hey, I just kicked off the blog with a complaint and a self-deprecating remark!  We’re two for two.

Anyway: the puzzle-minded among you know that Google Nexus has a Twitter feed on which they post an occasional contest.  If you are the first to answer the contest correctly, you win a new Google Nexus S phone.  Not bad, right?  Well, recently, they ran a very frustrating puzzle.  The idea was, Twitter users would suggest ten-character strings, and they would tweet back whether your string fit a particular pattern they had in mind. If you picked up on the pattern early, you could tell them what it was and win the prize.

The problem?  For some reason they were verifying user-submitted strings by hand, and trying to do so every minute or so.  This probably led to some very tired and frustrated Google employees, and … it led to some mistakes.  Their intended pattern was: letters in ascending order, 3-5 numerals, exactly 1 vowel.  Except they allowed two strings that didn’t fit the pattern.  And, if you were wracking your brains trying to figure out the pattern like I was, it just led to a few hair-tearing-out* hours.

* For lack of a better word.

So I got to thinking: why didn’t they just write a script to auto-reply for them?  It should be easy to write a Python script that would search for @-mentions, check for ten-character strings, and reply to a user whether or not his string fit the pattern.  I gave myself an hour one morning and came up with this.  It certainly does the job and can easily be set to run every minute or so to look for new replies.  It might need to be tweaked a little — you’d want to make sure there are about as many “yes” replies as “no”, and you’d probably want to limit the total number of replies to somewhat less than 20 per minute.  But the point is: Google has much better Python coders than me.  For about an hour of coding (and some beta testing to be careful) they could have avoided a lot of trouble for themselves and a lot of gut-wrenchiness* for the rest of us.

* See above footnote

Okay!  No more complaining!  Next time, we’ll talk a little bit about the technical aspects of making my puzzle for BEQ’s site without Crossword Compiler.  If you’re interested in making JPZ puzzles, you might want to stay tuned.