What 3 words to generate passwords

[HPlum78]

Have been playing around with using PowerShell and what 3 words for password generation, thought it might be useful to share as some of you may use it.

 

$long = get-random -Minimum -90.00000 -Maximum 90.00000
$lat = get-random -Minimum -180.00000 -Maximum 180.00000

$long = [math]::round($long,5)
$lat = [math]::round($lat,5)

$Words = Invoke-WebRequest -Method Get "https://api.what3words.com/v3/convert-to-3wa?key=Your_API_KEY_HERE&coordinates=$long, $lat&language=en&format=json"

$words = $words | ConvertFrom-Json

$words.words | ConvertTo-SecureString -AsPlainText -Force -OutVariable pwd
$pwd

 

You will need to register for a free dev account on the What 3 words site (this gives you a 1000 free calls a month) and edit the line $Words = Invoke-WebRequest -Method Get "https://api.what3words.com/v3/convert-to-3wa?key=Your_API_KEY_HERE&coordinates=$long, $long&language=en&format=json" and replace the "Your_API_KEY_HERE" with your actual API key.

 

Clearly there is stuff you can do with the words like change the . to other chars and add a random number to the start/ end and such likes but its a starter for ten.

Edited August 24, 2021 by HPlum78

[andy_b]

Dinopass https://www.dinopass.com/api might be worth a look at too?

[Zammo]

I presume what3words is very careful about making "interesting" combinations?

 

I had a password generator the other day spit out "BentGirl17!" or something similar, and the even shakier "BlackFailure1_?" which I felt was one to avoid....

[HPlum78]

You would hope that they have thought about the combinations and when they put it together you can bet that they had a whole list of banned words.

[HPlum78]

TBH it would not take much to get all the combinations using powershell and the API. Thats why i say you need to add your own randomisation to the output from what 3 words.

[HPlum78]

My interest was sparked so i did a little digging in to what 3 words and by all accounts there are ~170,000 words in the Oxford English Dictionary by the time they had removed the words that could not be used they where left with ~40,000 words to use for the required 57 trillion unique 3 word combinations! So even if i scraped all of the combinations using a script and we added no other randomisation the task of finding an account and matching it to a what 3 word generated combination is no small task in its self... But mixing it up with other randomisations stops an attack based solely on those 57 trillion combinations.

[ICTDirect_Dave]

You would hope that they have thought about the combinations and when they put it together you can bet that they had a whole list of banned words.

 

It still throws up a few amusing ones.

 

This for example

[HPlum78]

Thats perfect just perfect...

[HPlum78]

Some people have too much time on their hands @ICTDirect_Dave

[ICTDirect_Dave]

It was more than worth the 30-second google it took!

[HPlum78]

///clog.bottom.juices from my random clicking on the map

[jthompson]

This is a neat idea. But yes, always worth taking the time to pass any lists of generated passwords through a human blandification filter before dishing them out.

[andy_b]

Not gonna lie, this made me chuckle being near Bangkok..

 

///invite.back.passage

[HPlum78]

How long is it going to take the entire Edugeek community to click on the 57 trillion 3m3 tiles to find and list the funny combinations?

 

If you get the long/ lats we can exclude those in the script...

[HPlum78]

We should all bag a country/ an identifiable place...

I will do Bishop rock, would not like to be one who ends up with an ocean!

[ICTDirect_Dave]

Since they allow the words friend, member, touching etc, it's rather easy to put random combinations of similar words in and get some quite specific results!

[David44]

I'd be weary about adding a third party service as a requirement of the new account process. It can't be helped in some cases, you will probably need to set up Cloud accounts as part of the process but it would be a bit annoying if the process failed because the what 3 words API was down for some reason.

 

Also, I don't like how the company make it free to convert a location to three words but charge for reversing the process but that's not important if you are just using it as a random word generator.

[jmak]

I'd be weary about adding a third party service as a requirement of the new account process. It can't be helped in some cases, you will probably need to set up Cloud accounts as part of the process but it would be a bit annoying if the process failed because the what 3 words API was down for some reason.

 

Also, I don't like how the company make it free to convert a location to three words but charge for reversing the process but that's not important if you are just using it as a random word generator.

I can see how that could be an issue for large organisations, although I suspect they price it so that the operational efficiency savings outweigh the costs.

 

For personal use I have the app on my phone to find the three word address and then share it either to a navigation app or my car to get standard gps coordinates and directions which doesn't cost me anything.

[HPlum78]

@David44 that is a fair point and can be handled in code mind, if its a cloud service then it should all be cloud and if on prem it should be on prem only. But that limits our ability to find natty solutions in some cases.

[HPlum78]

And on that i could code a solution that could cache a few calls and make it so the random long lat dont use those for x amount of time.

[jthompson]

I wonder if it's worth maintaining a blocklist of words to check generated passwords against, to avoid culturally loaded or common password words. ///administrator.password.monkey is a valid w3w address, and might be okay from a password strength point of view, but you'd probably feel better skipping it, given the choice.