6 ms·

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You ne

by parfe 10y ago

>We suggest that you include five words of 5-10 letters in size, chosen at random, with spaces, special characters, and/or numbers embedded into words. >You need to be able to recall the passphrase that was used to encrypt the file. Why bother writing security guidelines which are impossible for a human to follow? edit: Try recalling any passphrases generated by the command below, and that's before the random sprinkling of punctuation. grep -E "^[a-z]{5,10}$" /usr/share/dict/words | shuf -n5 | tr '\n' ' '

HappyTypist 10y ago
Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"
- sib 10y ago
  For one specific site, no. But if you have 100-200 different passwords to remember, it's impossible for most people.
- jesseb 10y ago
  At work I constantly deal with people who can't remember passwords as short as 8 characters, you have to remember we're not representative of the average person.
  - keymone 10y ago
    you should ask them what they prefer - remembering 8 random characters or 4 random words
- LordKano 10y ago
  That's a good long term solution but when policies force you to change your password every 45 days, it falls apart. In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.
  - Spooky23 10y ago
    The good news is that the practice is going away NIST revised it's guidance/recommendation for password cycling.
  - COil 10y ago
    Yes indeed. For example they add the current year and month and keep the same "base password" which is unsafe.
    - e12e 10y ago
      "Password2017" is a typical "secure" password. Capital and small letters, and number - longer than 8 characters. Passes most "checks" for passwords...
      - koolba 10y ago
        "Password2017!" is even better. It's got a special character!
        falcolas 10y ago
        My favorite "pattern for stupid passphrase requirements" is "1qaz@WSX" - then just move a row to the right with every password change. :)
        quickben 10y ago
        Funny how most people go for ! as the default special character :)
        koolba 10y ago
        It adds to the excitement of logging into an application. Instead of "login", you get to "login!".
        LordKano 10y ago
        I think it's a natural outgrowth of how so many people chose "1" when they were forced to add a number to their passwords.
- eriknstr 10y ago
  Embedding special characters only makes it harder to remember correctly yet has little benefit. Your example is the same used in the xkcd where they explain this (except you've added an additional word at the beginning) so you've probably seen it already but I'll link it anyways. https://xkcd.com/936/ https://xkcd.com/936/
e12e 10y ago
I've been thinking about this for a while, and the early conclusion I've come to, is that 64bits of provable random entropy in a password that's also memorable is a very high bar to clear. Imagine this, you take four word types/groups, say, substantive, verb, adverb, preposition/place. You list 128 of each - all with identified uniqly by the first two letters. You let a machine pick a word from each column at random. The phrase is your mnemonic key, the password (to type in) is the first two letters of each word, concatenated. If you want to appease password strength checks, capitalise the first letter, and end the input with a period. So: "girl runs happily up", becomes "giruhaup" (or, with equivalent entropy, but satisfying "at least three symbol groups": "Giruhaup."). Now, that's then 4 picks out of 128 words, or an encoding of 4 times 7 bits (2^7=128) - 28 bits. You'd need three such passwords concatenated to break past 64 bits of entropy. And you'd have to type in 24 letters. That's pretty hard to type in blind without a typo. You might be able to use lists of 256 words - but it'd make it a bit more difficult to make the wordlists (because words should be identified by the first two characters) - and you'd still need two "phrases" and type in 16 characters. Adding random numbers, symbols or capitalization is probably not worth the challenge they add in remembering where they go, for the single/few bits of entropy they add. And I'm still not convinced 16 characters is short enough to be usable for "most people".
- shawn-furyan 10y ago
  Rather than rolling your own password system, I would recommend diceware.com for strong passwords (including master passwords) that you can memorize (I am bad at memorization, and have memorized 129 bit passwords this way, and 64 bit passwords are kind of a breeze to memorize). For the long tail of passwords that you shouldn't be memorizing in the first place, a password manager with a good configurable password generator is invaluable. I use Lastpass (I like the breadth of it's platform support: all major consumer OSes, all major mobile OSes, extensions for all major browsers). Alternatively, lot of people recommend 1password. Diceware has better guarantees, but the password managers are usually much more convenient[1]. I weigh these costs and benefits when choosing which way to go for a particular use case. [1] With the significant exception of passwords that will regularly have to be typed out on mobile, since diceware passwords are much more virtual keyboard friendly than random character generated passwords. This is partly because you can typically keep the entire thing in your head, not having to reference your password manager multiple times, and partly because they don't rely on special characters for their entropy, so can be typed out on the primary keyboard without switching to numeral or special character keyboards.
0xffff2 10y ago
I do this... I have 3-4 randomly generated passwords memorized. One for each "important" account (e.g. email, banking).
necessity 10y ago
s/human/me

by parfe 10y ago

HappyTypist 10y ago

Is it really impossible for a human to follow? "Shiny C0rrect H0rse Battery Staple!"

sib 10y ago
For one specific site, no. But if you have 100-200 different passwords to remember, it's impossible for most people.
jesseb 10y ago
At work I constantly deal with people who can't remember passwords as short as 8 characters, you have to remember we're not representative of the average person.
- keymone 10y ago
  you should ask them what they prefer - remembering 8 random characters or 4 random words
LordKano 10y ago
That's a good long term solution but when policies force you to change your password every 45 days, it falls apart. In my experience, overly restrictive password policies force users to choose passwords that are less secure and easier to remember.
- Spooky23 10y ago
  The good news is that the practice is going away NIST revised it's guidance/recommendation for password cycling.
- COil 10y ago
  Yes indeed. For example they add the current year and month and keep the same "base password" which is unsafe.
  - e12e 10y ago
    "Password2017" is a typical "secure" password. Capital and small letters, and number - longer than 8 characters. Passes most "checks" for passwords...
    - koolba 10y ago
      "Password2017!" is even better. It's got a special character!
      - falcolas 10y ago
        My favorite "pattern for stupid passphrase requirements" is "1qaz@WSX" - then just move a row to the right with every password change. :)
      - quickben 10y ago
        Funny how most people go for ! as the default special character :)
        koolba 10y ago
        It adds to the excitement of logging into an application. Instead of "login", you get to "login!".
        LordKano 10y ago
        I think it's a natural outgrowth of how so many people chose "1" when they were forced to add a number to their passwords.
eriknstr 10y ago
Embedding special characters only makes it harder to remember correctly yet has little benefit. Your example is the same used in the xkcd where they explain this (except you've added an additional word at the beginning) so you've probably seen it already but I'll link it anyways. https://xkcd.com/936/ https://xkcd.com/936/

e12e 10y ago

I've been thinking about this for a while, and the early conclusion I've come to, is that 64bits of provable random entropy in a password that's also memorable is a very high bar to clear. Imagine this, you take four word types/groups, say, substantive, verb, adverb, preposition/place. You list 128 of each - all with identified uniqly by the first two letters. You let a machine pick a word from each column at random. The phrase is your mnemonic key, the password (to type in) is the first two letters of each word, concatenated. If you want to appease password strength checks, capitalise the first letter, and end the input with a period. So: "girl runs happily up", becomes "giruhaup" (or, with equivalent entropy, but satisfying "at least three symbol groups": "Giruhaup."). Now, that's then 4 picks out of 128 words, or an encoding of 4 times 7 bits (2^7=128) - 28 bits. You'd need three such passwords concatenated to break past 64 bits of entropy. And you'd have to type in 24 letters. That's pretty hard to type in blind without a typo. You might be able to use lists of 256 words - but it'd make it a bit more difficult to make the wordlists (because words should be identified by the first two characters) - and you'd still need two "phrases" and type in 16 characters. Adding random numbers, symbols or capitalization is probably not worth the challenge they add in remembering where they go, for the single/few bits of entropy they add. And I'm still not convinced 16 characters is short enough to be usable for "most people".

shawn-furyan 10y ago
Rather than rolling your own password system, I would recommend diceware.com for strong passwords (including master passwords) that you can memorize (I am bad at memorization, and have memorized 129 bit passwords this way, and 64 bit passwords are kind of a breeze to memorize). For the long tail of passwords that you shouldn't be memorizing in the first place, a password manager with a good configurable password generator is invaluable. I use Lastpass (I like the breadth of it's platform support: all major consumer OSes, all major mobile OSes, extensions for all major browsers). Alternatively, lot of people recommend 1password. Diceware has better guarantees, but the password managers are usually much more convenient[1]. I weigh these costs and benefits when choosing which way to go for a particular use case. [1] With the significant exception of passwords that will regularly have to be typed out on mobile, since diceware passwords are much more virtual keyboard friendly than random character generated passwords. This is partly because you can typically keep the entire thing in your head, not having to reference your password manager multiple times, and partly because they don't rely on special characters for their entropy, so can be typed out on the primary keyboard without switching to numeral or special character keyboards.

0xffff2 10y ago

I do this... I have 3-4 randomly generated passwords memorized. One for each "important" account (e.g. email, banking).

necessity 10y ago

s/human/me