7 ms·
> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the
by gregmac 9y ago
> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character.
This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do?
I use a password manager and generate 30-ish character long passwords, and I still occasionally run into sites that tell me it's too long. No big deal, I just generate one at the max length they support, save it, and move on. It literally makes no difference to me, other than I scoff at the ineptitude of the people that built the site and have to click a couple more times to get a new shorter password.
- zeveb 9y ago> I use a password manager and generate 30-ish character long passwords Do note that you don't need anything more than 22 random mixed-case letters & digits: 26 lower-case letters plus 26 upper-case letters plus ten digits is 62, and 62²² ≈ 2¹²⁸. Completely agree re. the ineptitude of the developers of sites that try to limit one to less than that.
- jksmith 9y agodiceware.com
- throwawayReply 9y agoDiceware is good for encryption passkeys or for master passwords for password managers. It is awful for actual third-party passwords.
- WorldMaker 9y agoI also find Diceware-style wordlists useful for those "security questions" that are really "backup passwords for use over the phone". Instead of "real" answers to "What's the maiden name of my third grade elementary school teacher?" I try to roll a passphrase, store it in key/value section of the password manager. The Diceware might give "weird" words, but they are all at least pronounceable/describable to a human on the other end of a phone, which still matters in some cases.
- YPCrumble 9y agoThis says that "alger klm curry blond puck" is easy to remember. I would forget that very quickly.
- Ajedi32 9y agoYeah, the default word list is pretty terrible. Try one of the ones from the EFF: https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...
- knodi123 9y agough, the actual wordlist is a single hyperlinked sentence in the center of a thousand word essay. Here's a direct link: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt
- Ajedi32 9y agoThere are multiple word lists mentioned in that article, accompanied by an explanation of what types of words they include. Depending on your personal preferences, you might want to use a different list. That's why I linked the blog post and not the word lists directly.
- jksmith 9y agoThere are alternative lists you can look at.
- psychometry 9y agoYou need a mental picture/narrative to remember passphrases.
- gmuslera 9y agoTry to make a (short) story/idea connecting those random words. Stories, something with sense and meaning, are easier to remember. correct horse battery staple is the usual example about this.
- notzorbo3 9y agoDiceware encourages reuse of a single password on multiple sites. It's also much more time consuming than just clicking the "randomly generate password" button and having it spit out a 30 char password. That, and a randomly generated password of, say, 16 chars is much much more secure than a diceware generated password of 4 or 5 words, IIRC. And I'd still need a password manager, because reusing passwords on different sites / accounts is a big no-no.
- fredley 9y ago* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif https://blog.mamota.net/resources/img/wat_2.gif
- gambiting 9y agoHeh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.
- abainbridge 9y agoI hope you chose pa$sw0rd. The NHS online booking system my GP uses has rules like this. Pretty much guaranteed to prevent old people from being able to login.
- genpfault 9y ago> password must be between 7 and 8 characters long How do you enter a fractional character?
- Klathmon 9y agoThe "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...
- metalliqaz 9y agoHow often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.
- Ajedi32 9y agoYou have a phone, don't you? Just look up your passwords on there. You can even use something like InputStick to auto-type the password into the other computer if you'd rather not do it manually.
- metalliqaz 9y agoHmm... InputStick, that's a cool little gadget, never heard of that.
- drinchev 9y agoWorking on computers that aren't yours and remaining secure is quite challenging. I would recommend you to use any password, but rotate the credentials every time you enter them in one of these.
- donald123 9y agoConsider some portable password manager stored on a usb drive.
- robmcm 9y agoLogging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc. Copying over a really long generated password is much harder than an algo you can perform in your head.
- woobar 9y agoEven worse - entering a password into a device without keyboard. Smart TVs, streaming sticks, consoles, etc. Extra fun when every input character is immediately masked.
- katastic 9y agoI have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.
- pc86 9y ago> I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity. Of course passwords would be case sensitive, why wouldn't they be?
- katastic 9y agoI meant case INSENSITIVE. Apparently everyone thinks I'm a fuckin' retard over that of a typo. Great audience. 10/10, would post again.