Request for comments: ratpass

[Member techore]

Requesting comments on my first yad application. I have a question but looking for general feedback on the script.

One question I have is there an alternative on increasing the width using character versus pixels? I am not positive, but “–width” appears to be based on pixel and “–text-width” doesnt affect “–entry.” My concern is using ratpass with differing resolutions 1080p, 1440p, and 2160p and inconsistent dialog width, e.g. 300 width from 1080p to 2160p results with a dialogue half as wide in relation to the display resolution.

#!/bin/env bash
# Project: antix-dwm
# Location: /usr/local/bin/ratpass
# Dependencies: yad, hashrat, and xsel packages
# Description:
#   Tool to create a passwords using hashrat by entering two or 
#   more factors for low to moderate risk websites and removing
#   the need to memorize complex passwords or using a password safe.
#
#   For example:
#   "www.yahoo.com 12345678" results with "c5VhyoBYs5Y6t9FAF0C0rXvlVRY="
#
#   To reduce or increase password complexity, update
#   "hashrat -sha1 -64" but retain "-rawlines" to prevent hashes
#   being stored in shell history. See "man hashrat" for details.

hashstr=$(yad --title="ratpass" --center --splash --undecorated --borders=10 --width=300 --skip-taskbar --text="Text to hash:" --entry --button="Copy":0)

if test $? -eq 0 ; then
    printf "$hashstr" | hashrat -sha1 -64 -rawlines | tr --delete "\n" | xsel --clipboard
else
    exit
fi

Also, I want to share and say “Thank you” to the antiX community. After fighting with antiX’s yad applications in developing the antiX dwm spin, I kind of hated yad. This project was intended to check my bias so I could form an informed opinion. I have to admit, it’s not bad. It’s not perfect but it is so much easier then using tkinter (or gtk or qt). It is growing on me. Thank you, all.

• This topic was modified 1 month, 3 weeks ago by techore.
• This topic was modified 1 month, 3 weeks ago by techore.

[Moderator Brian Masinick]

Helpful

Up

0

::

I don’t know exactly what this application does, so I’m not sure why it needs a wide or long window.
If 300 works to display what you need, isn’t that fine?

I don’t know if a 10 pixel border is appropriate or not; depends on what you want it to look like.
Off the top of my head, I think that a 300 pixel area is wide enough for passwords, but if you want more,
try 320, 340, etc. or just bump it to 400. Based on the few simple apps I’ve either copied or used,
I think you’re right on. PPC has done quite a bit with yad, maybe he will have better suggestions,
otherwise I think what you have is fine.

--
Brian Masinick

[Member techore]

Helpful

Up

0

::

I wasn’t clear on my concern which I will edit now.. and restate here.

The problem with using pixels is it’s doesn’t increase or decrease based on resolution so a 300 pixel width dialogue on on 1080 pixel width veruss 2160 pixel width results with a dialog 1/2 the size. If it done my character, increasing the font dpi, e.g. Xf.dpi, results in a more uniform appearance. A percentage may even be better.

Maybe I am too concerned. It really about usability for others not so much myself.

[Member Robin]

Helpful

Up

1

::

Hi techore,

I know this width issue of yad very well and have invented the following line in my scripts to overcome it:

w=$(($(wmctrl -d | grep -F ' * ' | tr -s ' ' | cut -d ' ' -f4 | cut -dx -f1)*100/682))

Just use the variable $w instead of the fixed value 300. This will create a 300px wide window on a 2048 px wide screen, while on a 1048 px wide screen it will show an 150px wide window instead and on a 4096px wide screen it comes up with a 600px wide window. The command executed to get the value simply asks wmcontrol for the recently active desktop and cuts from its answer the needed width value for use in bash arithmetics. Modify the multipliers to get a different base size according to your needs, but keep in mind bash does integer arithmetics only.

Many greetings
Robin

——————
P.S.: I’m pretty sure yad doesn’t know the option –padding, you probably want –borders= which you have already added.

Windows is like a submarine. Open a window and serious problems will start.

[Moderator Brian Masinick]

Helpful

Up

0

::

Thank you Robin for your valuable algorithm to produce a relatively consistent size for
the yad display window.

--
Brian Masinick

[Member techore]

Helpful

Up

0

::

Robin wrote:

I know this width issue of yad very well and have invented the following line in my scripts to overcome it:

Perfect! Thank you.

Hm.. I don’t have wmctrl installed but it’s tiny. I’ll need to add it to the list of dependencies, but nice solution. Thank you, again.

• This reply was modified 1 month, 3 weeks ago by techore.

[Member techore]

Helpful

Up

0

::

Robin wrote:

P.S.: I’m pretty sure yad doesn’t know the option –padding, you probably want –borders= which you have already added.

Good catch. Thank you.

[Member Robin]

Helpful

Up

0

::

techore wrote:

I don’t have wmctrl installed but it’s tiny

Strange you don’t have it. On antiX 21, 22 and 23 this tool is installed by default, it was always present for me (And I believe to remember it was there already on antiX 19 and 17, but not sure anymore about this.) And maybe this is only true for full?

Another chance is xdotool, which can also provide the needed base value, but this is way more complicated than to ask wmctrl.

Windows is like a submarine. Open a window and serious problems will start.

[Member techore]

Helpful

Up

0

::

Using antiX Core. I don’t mind that it’s missing. Less is more! 😀

wmctrl isn’t working for me. I suspect there is an assumed package not installed but it’s okay. You presented me with an excellent solution. I just need to swap out wmctrl for something else.

I think that xrandr will work, but I will look at xdotool as you suggested, too.

This works for obtaining the y axis resolution. Undecided if that the right direction, but I’ll sleep on it and get it done tomorrow.

xrandr |grep current |awk '{ print $10 }' |tr ","

• This reply was modified 1 month, 3 weeks ago by techore.

[Member techore]

Helpful

Up

0

::

Couldn’t sleep, so..

#!/bin/env bash
# Project: antix-dwm
# Location: /usr/local/bin/ratpass
# Dependencies: yad, hashrat, and xsel packages
# Description:
#   Tool to create a passwords using hashrat by entering two or 
#   more factors for low to moderate risk websites and removing
#   the need to memorize complex passwords or using a password safe.
#
#   For example:
#   "www.yahoo.com 12345678" results with "c5VhyoBYs5Y6t9FAF0C0rXvlVRY="
#
#   To reduce or increase password complexity, update
#   "hashrat -sha1 -64" but retain "-rawlines" to prevent hashes
#   being stored in shell history. See "man hashrat" for details.

# Determine current resolution height, e.g. 1080, 1440, 2160, etc.
# r is the resolution height | 1920x1080 results with 1080
r=$(xrandr |grep current |awk '{print $10 }' |tr -d ",")

# Calculate the width of dialogue using w = $r * (300/1080).
# 1080 results with 300 width where 2160 results with 600 width.
w=$(printf "%.f" $(echo "$r * (300/1080)" | bc -l))

hashstr=$(yad --title="ratpass" --center --splash --undecorated --borders=10 --width=$w --skip-taskbar --text="Text to hash:" --entry --button="Copy":0)

if test $? -eq 0 ; then
    printf "$hashstr" | hashrat -sha1 -64 -rawlines | tr --delete "\n" | xsel --clipboard
else
    exit
fi

I still need to test the different resolutions to determine target dialog width.

Attachments:

1. 

   ratpass.jpg
   

[Member Xunzi_23]

Helpful

Up

0

::

Had to take a look what hashrat is about.
I use pwgen: pwgen -s 30 5 -1 -y minimum of 30 random characters. I can not remember the long generated results, same seems likely for hashrat.

From main hashrat page, for dunces like me who do not know about the application or some of its capabilitys.
1) Password Generator, words of the author:

I mostly use hashrat for generating passwords. I already have a number of simple passwords/passphrases that I can remember, and when generating a password for a website I combine the website name with the password, then I hash the whole lot. Including the website name means that the resulting hash will be unique to the website. So, for example:
sh-4.2# /usr/bin/hashrat -64 -sha1 -lines
ebay.com/password
38v+fhAbErn/W1UyjAnkCuygi7Y=

produces a different string to
sh-4.2# /usr/bin/hashrat -64 -sha1 -lines
facebook.com/password
1RG7Zvm9ksEgq4znJSwWwTRrRIM=

This output string can then be used as a password for the website. Obviously this system only works in environments that support cut-and-paste. However, in order to ensure my passwords are unique to me, and won’t be the same as anyone else who is using hashrat and entering facebook.com/password, I add a ‘pin number’ to the end of the input string, so now I’ve got:
facebook.com/password/12345
l/SbvIlvzheHgJWjy+J+mYQ9wl4=

Obviously, you shouldn’t use ‘password’ as your password or ‘12345’ as your pin. But using this method I can generate a unique, strong password for any website I visit, leveraging existing passwords that I can easily remember. If the website is hacked, and their password database stolen, it’s highly unlikely that a strong password like these hashes will ever be broken. For the crackers, there’s an early payoff through checking for passwords that are common names or dictionary words, and there’s much less value to trying to brute-force complex, passwords like these. Even if they do, they only have a password that is a unique string for the given site, not a password that might be usable at other websites I frequent. Hashrat also has a ‘cgi mode’ where it can be run as a cgi program and thus used through a web-browser.

• This reply was modified 1 month, 3 weeks ago by Xunzi_23.

[Member techore]

Helpful

Up

0

::

@Xunzi_23, Exactly and thank you for providing context and the author’s information.

My current solution for $r is flawed. After a nights rest and looking at it doesn’t take into account users stacking displays and it does not identify the current display device and its resolution. Also, I am using the vertical resolution, but it may make more sense to use the horizontal resolution. Going to explore xdotool at @Robin suggestion, take another run at wmctrl, and continue researching.

Thank you, all, for the suggestions and comments.

source: https://gitlab.com/techore/antix-dwm/-/blob/main/file/bin/ratpass

[Member techore]

Helpful

Up

0

::

xrandr | grep \* | awk '{print $1}'

xdpyinfo | grep dimensions | awk '{print $2}'

Both result with 1920×1080 or 3840×2160 for the respective display. Now to find a second monitor to verify the results are consistent.

[Moderator Brian Masinick]

Helpful

Up

0

::

techore wrote:

xrandr | grep \* | awk '{print $1}'

xdpyinfo | grep dimensions | awk '{print $2}'

Both result with 1920×1080 or 3840×2160 for the respective display. Now to find a second monitor to verify the results are consistent.

I only have a single monitor laptop, but for what it’s worth I can at least confirm that both commands return the values 1920×1080.

--
Brian Masinick

[Member Robin]

Helpful

Up

0

::

Some additional suggestions:

1.) Concerning xdotool: Maybe it was wrong recollection merely, I was pretty sure the value can be retrieved from xdotool (and also think I’ve done this once already, it was a pretty complex syntax to follow, but I can’t find my notes about how it was done, so I might be wrong in this point)

2.) To calculate the width I believe you’d better use the horizontal value, not the height, which might cause wrong width calculations for portrait oriented displays possibly. The following will output the width value instead the height:
$ xrandr | grep current | awk '{print $8 }'

3.) Why installing this hashrat tool instead simply using what is present by default on antiX?
shasum -a512 <<<"test 12345" | cut -d' ' -f1

Or, if you want actually install something new, you could use a hash algorithm which is a bit more hardened against brute force, eg. argon2
sudo apt-get install argon2

4.) Add a user-specific, randomly generated locally stored salt to avoid multiple users creating identical pass-strings from their simple and easy to remember pass phrases. It could be generated by e.g.
echo "my_test_salt_$(shasum -a512 <<<"$RANDOM"|cut -d' ' -f1)" > ~/testsalt
Make sure to set the permissions for salt file to 600
User should be made aware to backup his personal salt file in a safe place.

Then you can use this salt e.g. this way:
$ argon2 $(cat ~/testsalt) -r -d <<<"test passphrase 123"

Windows is like a submarine. Open a window and serious problems will start.

[Author]

Posts