13 ms·

Write your passwords down

116 points by duck 16y ago

paulshort 16y ago
This password would be really hard to crack. T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck. T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.
- Sapient 16y ago
  With some Markov chain generators and leetification, not as hard as you think.
- techiferous 16y ago
  I consider this the geek equivalent of using "password" or "123456". It is so common for tech people to do this. The real security here is the length of the password, not the special characters.
teralaser 16y ago
Here is another reason to write your passwords down: At my workplace there was a programmer. One day he had a heart attack, and was put into a 3 week artifiscal coma. When he woke again, he could not remember any passwords. Everything was a pain. To this day, his website ends the day, he had the attack.
- brown9-2 16y ago
  I think what you have here is more an argument for making sure there are redundancies in who has access to your vital systems. Not so sure how my loved ones would feel about my employer asking to go through my personal effects if I was in a coma.
DanI-S 16y ago
Although this method may be great for you, it doesn't seem worth it to me. Having your passwords hacked or guessed is bad because it's a hassle, and it can lead to you losing time and money. This method of password generation/storage is also a hassle, and definitely leads to losing time (which may translate to money). I find it far easier to come up with a reasonably long and complex 'base' password, then tag an extra bit to the end depending on which site you're accessing. Since our memory is strongly context dependent, it's easy to remember the extra little bit for the site you're currently on.
michael_nielsen 16y ago
I use Bruce Schneier's password safe: http://www.schneier.com/passsafe.html http://www.schneier.com/passsafe.html
iuguy 16y ago
This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password (http://agilewebsolutions.com/onepassword http://agilewebsolutions.com/onepassword) or Keepass (http://keepass.info/ http://keepass.info/).
- joshkaufman 16y ago
  This looks like a good way to generate the passwords you put into 1password or another similar password tool. If the tool fails, you can regenerate the passwords if you need to.
  - MikeCapone 16y ago
    1Password has a random password generator. That's what I use.
- Legion 16y ago
  Keepass is brilliant and supported on Linux, Mac, and Windows. I have one super-strong password that I've memorized that encrypts my KeePass database, and then I use Keepass to generate and store random passwords for me.
- snes 16y ago
  No one mentioned Lastpass? It has a multifactor grid authentication, which along with a user defined password, makes it secure enough for me. When I started using it, I changed most of my passwords to be 100 characters long. But many sites had a maximum 20 characters or equivalent rule.
stevelosh 16y ago
Use 1Password, make sure your passphrase for that is long enough to be secure. Write that passphrase down and put it in a safety deposit box if you want people to be able to retrieve them after you die.
jdludlow 16y ago
Back in 2005, I did something similar for a while after this [1] was posted to /. Eventually it became too annoying, and I switched to Password Safe and then to 1Password. Both are, in all ways, better than that slip of paper. [1] http://ask.slashdot.org/comments.pl?sid=152097&cid=12762593 http://ask.slashdot.org/comments.pl?sid=152097&cid=12762...
cliveholloway 16y ago
In related news, when I'm on a non essential site that requires a password, forces a weird restriction ("Your password must contain at least one number and one non word character) and won't let me save it in Firefox, I just copy the password, log out, bookmark the login page and then add #password to the URL and bookmark that as the new login page. Then, come login, I can just copy the password from the URL.
mikeryan 16y ago
Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.
- nowarninglabel 16y ago
  Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over again...it is so painful to watch some people try half a dozen, even a dozen times and still not get a password that will work, and then the vast majority will either write it down in a public place, share it, or forget it. I'd based on the available data that could have just as much security, without all the user hassle, if we just require long passwords, no other requirement. Can you see how much easier it is to just say, your password has to be 16 characters or longer. Just think of a passphrase. For instance: IWa1kmydogonSaturdays Easy to remember, and I would argue, though would want to try to provide some evidence, that this would be just as, if not more secure than 8 characters with ridiculous requirements.
  - gjm11 16y ago
    > if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".
    - trafficlight 16y ago
      I'd go with passwordpasswordpasswordpassword. Just to be safe.
      - 16y ago
kirinkalia 16y ago
I wouldn't store passwords in my wallet either and find this system far too cumbersome. I think if you're really concerned about security, you should never "remember" your password on any site -- see story about stupid criminal who stole a Washington Post reporter's laptop and posted photo of himself on the reporter's son's Facebook page: http://blog.washingtonpost.com/story-lab/2010/12/post_4.html http://blog.washingtonpost.com/story-lab/2010/12/post_4.html (the security of the teen's FB page isn't getting the same play as the stupid criminal angle).
corin_ 16y ago
Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his third and fourth rules ("Use mixed-case, numbers and special characters" and "Use passwords of at least 12 characters") you really should be fine, and you'll have an easier time memorising them. (I can remember multiple 20+ character passwords that would be very difficult to crack, and have no need to write them down.)
- jakehow 16y ago
  The problem with this approach is that you can only remember a few passwords like this, which means that you are going to reuse passwords on multiple sites. One site compromise can compromise multiple accounts for you.
  - corin_ 16y ago
    I don't have any problem remembering them personally (then again, I still remember root passwords I used when I was thirteen and they were completely random characters). Sites like HN and Reddit I'm happy to use the same password (I'd be minorly annoyed, but realistically I wouldn't be that fussed if I lost control of either account, I can either recover it or even create a new one), but any site where someone finding my password could cause a problem has its own password, and I can remember them all. Occasionally I forget which password goes with which site, but not often - actually I find it harder to remember which username/email goes with each site.
    - JacobAldridge 16y ago
      actually I find it harder to remember which username/email goes with each site So very true. My password creation process is fairly memorable, and tends to meet the requirements of any site (password length, numbers, capitals etc). But user names - it's an email address, it's the name on your email address, they do accept spaces, they don't accept spaces, they only have 8 characters ... drives me mad !
joshkaufman 16y ago
An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm https://www.grc.com/passwords.htm Be sure to use a fixed-width font.
- tudorachim 16y ago
  From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again." Interesting guarantee for a random number generator to provide...
  - tghw 16y ago
    Obligatory: http://search.dilbert.com/comic/Random%20Number%20Generator http://search.dilbert.com/comic/Random%20Number%20Generator
  - sukuriant 16y ago
    It might be true random numbers as opposed to pseudo-random numbers. Likely created in a similar way to http://random.org http://random.org
- flogic 16y ago
  While I'm reasonably sure they're on the level, getting my random numbers from a source not under my control is worrying.
  - raineri 16y ago
    Here is a python script to generate the table: http://pastebin.com/UiLi61Yg http://pastebin.com/UiLi61Yg
aquinn 16y ago
I read a story on HN a while back about a guy who used an algorithm to generate his passwords. Don't have the link but something like combining easy to remember bits of personal information. e.g mother's name, kids birthday, maybe changing the case of these. Also adding something site specific like the last three letters of the url backwards. It's easy to remember passwords this way but if one gets out they're all vulnerable if someone looks closely.
ali001 16y ago
I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in the firefox community), as well as Collin Jackson and Dan Boneh who are highly regarded security experts at Stanford. Also, if you're interested, I've created a command line utility for Mac OS X that exposes the same functionality: https://github.com/ali01/pwdhash.py https://github.com/ali01/pwdhash.py
- dchest 16y ago
  Just yesterday I wrote a Chrome extension with the same idea. Algorithm is: password = base64(pbkdf2(secret, username@url)) Where PBKDF2 uses SHA-256 and 5000 iterations. You can get it here: https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemkibgibljklhlfco https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemk... Website version: http://sellme.ru/p2 http://sellme.ru/p2 Source: https://github.com/dchest/cryptopass/ https://github.com/dchest/cryptopass/
- crocowhile 16y ago
  The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.
  - tghw 16y ago
    Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).
    - crocowhile 16y ago
      I use a hashing bookmarklet myself. Only, I wish there was a better algorithm and I think it's wise, at least with an audience like HN, to point the weaknesses of those system. See for instance : http://stackoverflow.com/questions/554224/is-the-bookmarklet-password-generator-from-supergenpass-com-safe-to-use http://stackoverflow.com/questions/554224/is-the-bookmarklet...
samuel 16y ago
So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator). The paper could be photocopied and returned to your wallet and you'd never know. Please, don't talk me about how many bits of entropy your passwords have. They aren't secure.
- lukeschlather 16y ago
  Why do you believe he gave you the real algorithm?
  - sophacles 16y ago
    Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.). However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.
    - flogic 16y ago
      Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.
      - 16y ago
Abid 16y ago
I always have a question come to mind whenever I read these kinds of guidelines: what percentage of computer users have ever had their passwords compromised? I'm guessing there's no real way to gauge this because I've never seen a study nor heard anyone else touting one and yet, complex password protection guidelines are always being recommended. Why?
- xlevus 16y ago
  I have no idea about the percentages. But I've been hit twice. One by a leak from a sizable gaming website, and the other time by gawker. Neither time I gave a shit because thankfully I was smart about my passwords. There's always a risk, it's not expensive to defend against, so why not?
  - Abid 16y ago
    Those are interesting examples because you didn't lose the passwords, those websites did. So stuffing your password in your wallet, or making sure they were 12 characters long wouldn't do any good.
crocowhile 16y ago
> (I have a second copy of that sheet left with a friend in an envelope) I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either). One needs to explain to users two things: the first is that there is a big difference between being A target and being THE target. If you are just A target, picking one password for each website you subscribe to is more than enough. If you are THE target, then people will get to you, no matter how secure you think you are.
- jgrahamc 16y ago
  I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into. BTW Do you use the same password on your Gawker account elsewhere?
  - msg 16y ago
    I usually have two passwords: A stupid one that I only use on stupid sites, and a good one that I use on crucial ones (Gmail, Amazon, bank). There's no relationship between the good and bad passwords, so I feel more confident that I'll be unaffected by data breaches. I checked the torrent and I guess I never made a Gawker account.
    - jmulho 16y ago
      The problem with that plan is that one day you will learn that someone who works at Google, or Amazon, or your bank or some other "crucial" site has captured millions of username/password combinations and tried them at all the other crucial sites.
  - crocowhile 16y ago
    As long as the password is unique, it doesn't even matter. Sure, it should be unique yet not revealimg a pattern ("goofy" is ok, "gawker" is not) but there is no need for the user to pass crypto 101. This for those 1.5m that were just A target; Nick Denton, OTH, was THE target and it was just matter of time for him to get pwned. >BTW Do you use the same password on your Gawker account elsewhere? I had to check the other day. I opened that account to leave one comment on lifehacker (that was never approved, actually) and then forgot about it. Turns out the password was safe enough but my mistake there was to use an email address I cared about. Now I have a less important email address and a supergenpass for everything, except gmail/facebook/dropbox and the other things I care about, for which I have better passwords.
jasonjei 16y ago
It's an interesting concept because passwords could be infinitely more secure if everything adopted a two-factor authentication system with something physical that you carried around like an RSA SecurID. Unfortunately, even that system risks being compromised, and like the sheet of paper, highly inconvenient. But on the other hand, your garage door works with a rolling keY too, and you're also SOL if you lose your opener (unless you, ironically, have a keypad).
- kgo 16y ago
  I did some consulting work at a big pharma company. And they solved the whole problem of someone stealing (or more likely losing) a RSA key by keeping all the keys at the helpdesk! You just called up, said you need the ID, and they read you the number over the phone... Me: "Hi I'm XXX and I need the RSA key for COMPANY X." Helpdesk: "Okay... It's on the board here somewhere... Found it... It's down to the last bar. Let me wait until it flips... Okay. Six bars... 643332." Me: "Thanks a million."
s2r2 16y ago
http://en.wikipedia.org/wiki/Shamirs_Secret_Sharing http://en.wikipedia.org/wiki/Shamirs_Secret_Sharing Write parts of your password down in several places, collect some of them (say, 8 of 10) to reconstruct it (completely!) if you've forgotten it; let someone who finds your wallet with one part of it know nothing.
deleted 16y ago
[deleted]
jcromartie 16y ago
I wrote a quick Ruby script that prints out a tabula recta for passwords. Enjoy! https://gist.github.com/745446 https://gist.github.com/745446
klochner 16y ago
My policy: - lame passwords for sites I don't care about (e.g., 'insecure') - the same password for sites with semi-sensitive information (e.g., facebook) - unique passwords for bank accounts, servers, etc. So I try to strike a balance between difficulty in remembering & security.
- techbio 16y ago
  Thanks for spelling that out entirely clearly.
- kanru 16y ago
  If once one of your password leaked, all sites with the secure level are unsafe then.
- bigiain 16y ago
  The thing that's bitten me on the ass a few times with that strategy is failing to upgrade sites from "I don't care about" status. I'll use the 'insecure' password to drop a comment on an interesting discussion on a site I've just found - like, say HackerNews or Twitter, then two years later I'm still participating in the community there, and it _could_ have still had the password I used that time to comment on a ValleyWag story. All of a sudden I _do_ care a bit about any reputation I might have. I was fortunate this time not to have any sites I cared about still using the same old password Gawker leaked (mainly 'cause I'd learned that lesson when my twitterstream started spamming acai berry sites when PerlMonks exposed my low-grade password back then.) I think Schenier's right - the world isn't a place where "remembering passwords" works any more. We need too many of them and we don't have enough control over how other people store them. A password safe with a strong passphrase backed up by somethig like dropbox or zumodrive is probably a minimum sensible approach now. Some care is needed with the devices you access that password safe on, and awareness of how software like browsers or your OS caches and stores any passwords it sees you use. Even with a properly secured password safe, a fair number of my logins are probably hosed if I lose my laptop... Firefox, Chrome Safari, Mail.app, Twitter clients, IM clients, IRC programs, FTP programs - all of them store credentials for me, _mostly_ in Mac OS X's keychain, but not in a "reliable enough way" to be considered "secure" if the physical hardware is in someone else's possession.
techbio 16y ago
Post-IT pswds.
DenisM 16y ago
Write them down to a file, and encrypt the file with a single passphrase. You only need to remember one thing. There are many tools that let you do that on your mobile phone of choice, including my own http://memengo.com http://memengo.com which has a benefit of also including the online backup feature in case you lose your phone.
- silversmith 16y ago
  Mobile phones get lost. Pieces of paper too. Online services die off. And then, you might want to log in from your mates computer. For me, the only usable password generation methods are those that fit in my mind.
ankimal 16y ago
What happens when you lose your laptop or netbook or whatever handy device you use to browse the web? Are you then leaving it to the OS login screen to protect everything? I d rather have passwords I remember in my head. If I forget often, I click the reset button/forgot your password. Whats more, I generally visit important places more often than unimportant ones, so I wont forget my important passwords. Also, start using sites like mint.com. Instead of logging into your bank account, log into mint to check balance and expenditures. Lets face it, none of this is every gonna keep you totally out of trouble. If you re so paranoid (aka my security professor at school), shut all your online accounts down.
jhuckestein 16y ago
I like the direction, but the obvious caveat are websites or weird legacy systems that don't allow you to have certain characters in your password or otherwise restrict it. And then there's the whole trouble of sites that require a username that you need to remember and that is usually restricted in ridiculous ways.
giberson 16y ago
I employ what I like to call "Personal Hashing". Think of it like the human version of md5. I've come up with an easy to remember, easy to compute (work done in my head), hashing system that I use to generate passwords for all my accounts. The power of this method is that it generates strong passwords, and is easy to remember. Take for example, and this is just a sample not my own personal hash formula, the following mechanism: key = username 1) r = rot2(key) 2) password = vowelreplace(r) [a4,e3,i1,o0,u_] In this example, I apply a rotation of 2 letters to the input key, then replace the vowels in the result with numbers. A sample use case might be for an amazon account. Username: johnsmith Password Key: johnsmith Password Phase 1 (rot2): lqjpuokvj Password Phase 2 (vowelreplace): lqjp_0kvj We are quite capable of remembering simple formulas which we can use to generate our own passwords on demand. What's best is the formula exists in our heads, and can never be discovered laying around.
- Sapient 16y ago
  I may be missing something, but doesn't this give you the same password for all accounts with the username johnsmith?
sigil 16y ago
I generate a new random but semi-pronounceable password for every account using apg (http://www.adel.nursat.kz/apg/ http://www.adel.nursat.kz/apg/), then store it in one of several gpg-encrypted, replicated master password files. The first few times I use a newly generated password, I have to look it up in a master file. It's weird how quickly semi-pronounceable nonsense + some symbols get stuck in your head though.
16s 16y ago
I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on Windows Linux and Macs. All I need to do is recall my sentence (with proper punctuation).
- crux_ 16y ago
  Not to be snarky, but isn't your master password now sitting there, plaintext, in your command-line history? (Worse: when you accidentally do this in a terminal that's remoted somewhere.)
  - 16s 16y ago
    See my reply below. I seldom do it in a terminal and when I do only on my home machines. The command above is for explanation. If I showed you my app without that explanation, it wouldn't be the same.
- zcid 16y ago
  While my method isn't as secure as your most likely is, I prefer a simpler algorithm based upon the site name. I can perform my algorithm in my head and enter a password quickly and without having to refer to a terminal or another program. Btw, do you ever worry that your command history might be accessed to discover your passwords?
  - 16s 16y ago
    I use an app I wrote to do the sha1 so the sentence is not hanging around in bash history, but I do rely on the cmd prompt at times on computers at my house. Here's a screeshot of the app: http://i.imgur.com/tz255.png http://i.imgur.com/tz255.png No one but me uses it. So it's bare bones.
    - 16y ago
maw 16y ago
I don't write my passwords down, but I do use reminders in a code of sorts. An example: I have an account with the bank Bancomer. In Spanish, "comer" means to eat, so I refer to it as "eßenbanque". (I know it's "essen"; nobody likely to find my list would recognize the ß, though; it would be mistaken for a B.) If my password were "l4rryb1rd" (it's not) I might render it as "oiseaulázaro", just enough of a reminder, while still misleading. This scheme might not work so well in, say, Brussels, but here in Monolingüilandia I think it's reasonable, although I do wonder from time to time just how sound it really is.
- pavel_lishin 16y ago
  I use something vaguely similar for my passwords, but with Russian instead of spanish/german. Fun fact: the password based on Russian transliteration that looks NOTHING like any English word I've seen (imagine "cexuqakr3") trips the linux "too close to dictionary word!" warning while a less secure password that's based on two english words (imagine "bellykitten13") doesn't.
goldenthunder 16y ago
Another good way store passwords is to memorize a simple algorithm based on the topic of your password. Example: - last 3 letters - a static symbol (let's use %) - @ if it's online / & if it's not - 3rd 1st 4th letter of topic in Capital-lower-Capital format - follow with a short string to increase length and stump bruteforces (lets use gold158) So my password for hackernews would be: - ews - % - @ - ChK - gold158 ews%@ChKgold158 I'm no security expert, but that seems to be pretty secure and it will be different for each password. You won't ever be in trouble if you forget a password and it doesn't require you to carry around written passwords. If you scramble it a little better than I did in my example, it will look random and no one will try to "reverse engineer" your algorithm. (So when someone needs your password temporarily, you can tell them)
deleted 16y ago
[deleted]
naner 16y ago
Anyone else try to log into John's HN account just to make sure he didn't make a very bad mistake (by posting the actual sheet he uses)?
FrankBlack 16y ago
I'll get my mom on this right away. :)
rapind 16y ago
I use a great little tool called PasswordMaker that I actually found in the comments of a thread here a long time ago. Here's a brief summary: http://blog.rapin.com/better-authentication-password-management http://blog.rapin.com/better-authentication-password-managem...
sullof 16y ago
I think that using password schemes is bad. Because in order to be useful, the method needs to be fast, simple and replicable. Suppose that someone creates a fake website in order to grab one of your smart passwords. If he understands that you use a method, he will try to deconstruct the method based on the fact that his website surely is included in some manner in the password itself. Also, since many people who use these methods tend to divulge them to the community, there isn't even a need to create a fake website to understand your passwords. The only solution that really works is to use a password manager. My favorite obviously is Passpack, because I am a co-founder, but regardless of which software you choose the important thing is that you use it. My advice is not to relay on any clever schemes because you may be in for a bad surprise.
devinfoley 16y ago
"Write them down and keep them in your wallet because you are good at securing your wallet." I'm having a very difficult time articulating just how horrible this idea is. Now if somebody compromises your password list, by either finding or stealing your wallet, they also get all of your personal and banking information as well! There is a reason that the government advises people not to carry their Social Security cards in their wallet (http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/446/~/carrying-a-social-security-card-in-a-wallet http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/446/~/ca...). I use Wallet, a password manager/generator that's available for OS X and iOS, supports encryption, and syncs between devices automatically. I use a different random, strong password for all of my accounts, and it's easier to manage than keeping lists of passwords. Works for me.
desigooner 16y ago
for something easy to use, I use character names from foreign films and texts, modified with a certain character replacement and displacement..

116 points by duck 16y ago

This password would be really hard to crack. T#!$ p@$$w0rd w0uld &e re@lly #@rd t0 cr@ck. T#!$p@$$w0rdw0uld&ere@lly#@rdt0cr@ck The passwords for my important stuff look much like the above. Just write a sentence that's easy to remember, replace letters with the special characters they look like and blend it all together. Works a treat.

Sapient 16y ago
With some Markov chain generators and leetification, not as hard as you think.
techiferous 16y ago
I consider this the geek equivalent of using "password" or "123456". It is so common for tech people to do this. The real security here is the length of the password, not the special characters.

teralaser 16y ago

Here is another reason to write your passwords down: At my workplace there was a programmer. One day he had a heart attack, and was put into a 3 week artifiscal coma. When he woke again, he could not remember any passwords. Everything was a pain. To this day, his website ends the day, he had the attack.

brown9-2 16y ago
I think what you have here is more an argument for making sure there are redundancies in who has access to your vital systems. Not so sure how my loved ones would feel about my employer asking to go through my personal effects if I was in a coma.

DanI-S 16y ago

Although this method may be great for you, it doesn't seem worth it to me. Having your passwords hacked or guessed is bad because it's a hassle, and it can lead to you losing time and money. This method of password generation/storage is also a hassle, and definitely leads to losing time (which may translate to money). I find it far easier to come up with a reasonably long and complex 'base' password, then tag an extra bit to the end depending on which site you're accessing. Since our memory is strongly context dependent, it's easy to remember the extra little bit for the site you're currently on.

michael_nielsen 16y ago

I use Bruce Schneier's password safe: http://www.schneier.com/passsafe.html http://www.schneier.com/passsafe.html

iuguy 16y ago

This is and isn't bad advice. Writing your passwords down and storing them in your wallet isn't necessarily a good idea. You may be able to secure your wallet, but there may be somewhere better to secure it (such as a house safe). Rather than writing the passwords down, use a decent tool like 1password (http://agilewebsolutions.com/onepassword http://agilewebsolutions.com/onepassword) or Keepass (http://keepass.info/ http://keepass.info/).

joshkaufman 16y ago
This looks like a good way to generate the passwords you put into 1password or another similar password tool. If the tool fails, you can regenerate the passwords if you need to.
- MikeCapone 16y ago
  1Password has a random password generator. That's what I use.
Legion 16y ago
Keepass is brilliant and supported on Linux, Mac, and Windows. I have one super-strong password that I've memorized that encrypts my KeePass database, and then I use Keepass to generate and store random passwords for me.
snes 16y ago
No one mentioned Lastpass? It has a multifactor grid authentication, which along with a user defined password, makes it secure enough for me. When I started using it, I changed most of my passwords to be 100 characters long. But many sites had a maximum 20 characters or equivalent rule.

stevelosh 16y ago

Use 1Password, make sure your passphrase for that is long enough to be secure. Write that passphrase down and put it in a safety deposit box if you want people to be able to retrieve them after you die.

jdludlow 16y ago

Back in 2005, I did something similar for a while after this [1] was posted to /. Eventually it became too annoying, and I switched to Password Safe and then to 1Password. Both are, in all ways, better than that slip of paper. [1] http://ask.slashdot.org/comments.pl?sid=152097&cid=12762593 http://ask.slashdot.org/comments.pl?sid=152097&cid=12762...

cliveholloway 16y ago

In related news, when I'm on a non essential site that requires a password, forces a weird restriction ("Your password must contain at least one number and one non word character) and won't let me save it in Firefox, I just copy the password, log out, bookmark the login page and then add #password to the URL and bookmark that as the new login page. Then, come login, I can just copy the password from the URL.

mikeryan 16y ago

Its funny I worked for a startup that got acquired by Comcast, and eventually we started having to follow the Comcast security policy which made us change domain passwords every month with requirements around using strange characters etc. I'd say about 50% of the people ended up with their current password on a post-it on their monitor or desk.

nowarninglabel 16y ago
Yes, this same thing happens on the ship I work on in the summers. There are about 300 people, and about half have to reset their password when they come on board. There is the arbitrary 8 character, at least 1 #, at least 1 special character, at least 1 capital, can't match a dictionary word, and can't be close to the previous password. Also can't contain their name. Try explaining that to 150 people over and over again...it is so painful to watch some people try half a dozen, even a dozen times and still not get a password that will work, and then the vast majority will either write it down in a public place, share it, or forget it. I'd based on the available data that could have just as much security, without all the user hassle, if we just require long passwords, no other requirement. Can you see how much easier it is to just say, your password has to be 16 characters or longer. Just think of a passphrase. For instance: IWa1kmydogonSaturdays Easy to remember, and I would argue, though would want to try to provide some evidence, that this would be just as, if not more secure than 8 characters with ridiculous requirements.
- gjm11 16y ago
  > if we just require long passwords, no other requirement ... then I bet lots of users will choose passwords like "passwordpasswordpassword".
  - trafficlight 16y ago
    I'd go with passwordpasswordpasswordpassword. Just to be safe.
    - 16y ago

kirinkalia 16y ago

I wouldn't store passwords in my wallet either and find this system far too cumbersome. I think if you're really concerned about security, you should never "remember" your password on any site -- see story about stupid criminal who stole a Washington Post reporter's laptop and posted photo of himself on the reporter's son's Facebook page: http://blog.washingtonpost.com/story-lab/2010/12/post_4.html http://blog.washingtonpost.com/story-lab/2010/12/post_4.html (the security of the teen's FB page isn't getting the same play as the stupid criminal angle).

corin_ 16y ago

Personally I don't see any reason for having them completely randomly generated. 'thIs1smyp4ssw0rd19%2' isn't any less secure than another 20 character password that includes lower+upper case letters, numbers and special characters. Obviously, if you do something like 'c0r1np4ssw0rd" then it may get to the stage where enough people do that for crackers to expect it (maybe it already is, but as long as you follow his third and fourth rules ("Use mixed-case, numbers and special characters" and "Use passwords of at least 12 characters") you really should be fine, and you'll have an easier time memorising them. (I can remember multiple 20+ character passwords that would be very difficult to crack, and have no need to write them down.)

jakehow 16y ago
The problem with this approach is that you can only remember a few passwords like this, which means that you are going to reuse passwords on multiple sites. One site compromise can compromise multiple accounts for you.
- corin_ 16y ago
  I don't have any problem remembering them personally (then again, I still remember root passwords I used when I was thirteen and they were completely random characters). Sites like HN and Reddit I'm happy to use the same password (I'd be minorly annoyed, but realistically I wouldn't be that fussed if I lost control of either account, I can either recover it or even create a new one), but any site where someone finding my password could cause a problem has its own password, and I can remember them all. Occasionally I forget which password goes with which site, but not often - actually I find it harder to remember which username/email goes with each site.
  - JacobAldridge 16y ago
    actually I find it harder to remember which username/email goes with each site So very true. My password creation process is fairly memorable, and tends to meet the requirements of any site (password length, numbers, capitals etc). But user names - it's an email address, it's the name on your email address, they do accept spaces, they don't accept spaces, they only have 8 characters ... drives me mad !

joshkaufman 16y ago

An easy way to create your own... Copy this empty table: http://pastebin.com/tzbd7FCt http://pastebin.com/tzbd7FCt Fill it with this random password generator: https://www.grc.com/passwords.htm https://www.grc.com/passwords.htm Be sure to use a fixed-width font.

tudorachim 16y ago
From the random generator's website: "Every one is completely random (maximum entropy) without any pattern, and the cryptographically-strong pseudo random number generator we use guarantees that no similar strings will ever be produced again." Interesting guarantee for a random number generator to provide...
- tghw 16y ago
  Obligatory: http://search.dilbert.com/comic/Random%20Number%20Generator http://search.dilbert.com/comic/Random%20Number%20Generator
- sukuriant 16y ago
  It might be true random numbers as opposed to pseudo-random numbers. Likely created in a similar way to http://random.org http://random.org
flogic 16y ago
While I'm reasonably sure they're on the level, getting my random numbers from a source not under my control is worrying.
- raineri 16y ago
  Here is a python script to generate the table: http://pastebin.com/UiLi61Yg http://pastebin.com/UiLi61Yg

aquinn 16y ago

I read a story on HN a while back about a guy who used an algorithm to generate his passwords. Don't have the link but something like combining easy to remember bits of personal information. e.g mother's name, kids birthday, maybe changing the case of these. Also adding something site specific like the last three letters of the url backwards. It's easy to remember passwords this way but if one gets out they're all vulnerable if someone looks closely.

ali001 16y ago

I think that a better solution is to use pwdhash. Check it out here: http://pwdhash.com http://pwdhash.com It's a browser extension for Chrome and for Firefox that seamlessly hashes the concatenation of your master password and the domain name of the site you're logging into. This produces a different password for each site, and requires you to remember only your master password. The extensions were created by Blake Ross (big name in the firefox community), as well as Collin Jackson and Dan Boneh who are highly regarded security experts at Stanford. Also, if you're interested, I've created a command line utility for Mac OS X that exposes the same functionality: https://github.com/ali01/pwdhash.py https://github.com/ali01/pwdhash.py

dchest 16y ago
Just yesterday I wrote a Chrome extension with the same idea. Algorithm is: password = base64(pbkdf2(secret, username@url)) Where PBKDF2 uses SHA-256 and 5000 iterations. You can get it here: https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemkibgibljklhlfco https://chrome.google.com/webstore/detail/hegbhhpocfhlnjmemk... Website version: http://sellme.ru/p2 http://sellme.ru/p2 Source: https://github.com/dchest/cryptopass/ https://github.com/dchest/cryptopass/
crocowhile 16y ago
The most commonly used hashers are pwdhash, supergenpass and magicpassword. Given that they all use hashing algorithms, none of them will result in a password using special characters, which is not optimal.
- tghw 16y ago
  Optimal? No. More than sufficient? Yes. You can use all numbers in your password, so long as it's long enough (and the website actually uses all of them).
  - crocowhile 16y ago
    I use a hashing bookmarklet myself. Only, I wish there was a better algorithm and I think it's wise, at least with an audience like HN, to point the weaknesses of those system. See for instance : http://stackoverflow.com/questions/554224/is-the-bookmarklet-password-generator-from-supergenpass-com-safe-to-use http://stackoverflow.com/questions/554224/is-the-bookmarklet...

samuel 16y ago

So you have a paper on your wallet, which can be used to obtain every password you use, using an intricate and very specific "algorithm". Then you publish the fact itself and the algorithm in your blog(real name), which, besides, doesn't depend on a passphrase (which could turn your method in a sort of dual factor authenticator). The paper could be photocopied and returned to your wallet and you'd never know. Please, don't talk me about how many bits of entropy your passwords have. They aren't secure.

lukeschlather 16y ago
Why do you believe he gave you the real algorithm?
- sophacles 16y ago
  Access to the piece of paper severely reduces the attack space, even if it isn't "go diagonal from (letter2, letter3) of domain name". Heck, it is not much different if it is a trivial transform on the characters themselves. Anything that a person could easily do (making the thing convenient enough to actually use) is not going significantly alter the number of permutations. Of course, this is making a big assumption that a targeted attack will go after the paper rather than say, the keyboard (which is generally much less secure than a wallet.). However, this being said, it is much more secure against untargeted attacks than the standard "i have an algorithms in my head" or "i use the same password" approach a lot of people use.
  - flogic 16y ago
    Once you're in the realm of targeted attacks you're in a whole different ball game. You have to consider who the attacker is likely to be and what they have access to. If your wallet isn't secure enough you can upgrade to a fire safe or some such. That narrows it do to people who you let in your home or are willing to break in. Beyond that though you're starting to enter into the realm of James Bond shit.
    - 16y ago

Abid 16y ago

I always have a question come to mind whenever I read these kinds of guidelines: what percentage of computer users have ever had their passwords compromised? I'm guessing there's no real way to gauge this because I've never seen a study nor heard anyone else touting one and yet, complex password protection guidelines are always being recommended. Why?

xlevus 16y ago
I have no idea about the percentages. But I've been hit twice. One by a leak from a sizable gaming website, and the other time by gawker. Neither time I gave a shit because thankfully I was smart about my passwords. There's always a risk, it's not expensive to defend against, so why not?
- Abid 16y ago
  Those are interesting examples because you didn't lose the passwords, those websites did. So stuffing your password in your wallet, or making sure they were 12 characters long wouldn't do any good.

crocowhile 16y ago

> (I have a second copy of that sheet left with a friend in an envelope) I love jgc but here he's making the same mistake most people make when they speak about security: assuming all readers have the same need for security and run the same risks. They don't. There is no point for my mom to adopt this system, it's way overkilled for her. (I think there's no point for me either). One needs to explain to users two things: the first is that there is a big difference between being A target and being THE target. If you are just A target, picking one password for each website you subscribe to is more than enough. If you are THE target, then people will get to you, no matter how secure you think you are.

jgrahamc 16y ago
I somewhat agree, but when mass hacks occur it opens people with poor passwords up to hackers because they've got all the time in the world to see whose accounts they can get into. BTW Do you use the same password on your Gawker account elsewhere?
- msg 16y ago
  I usually have two passwords: A stupid one that I only use on stupid sites, and a good one that I use on crucial ones (Gmail, Amazon, bank). There's no relationship between the good and bad passwords, so I feel more confident that I'll be unaffected by data breaches. I checked the torrent and I guess I never made a Gawker account.
  - jmulho 16y ago
    The problem with that plan is that one day you will learn that someone who works at Google, or Amazon, or your bank or some other "crucial" site has captured millions of username/password combinations and tried them at all the other crucial sites.
- crocowhile 16y ago
  As long as the password is unique, it doesn't even matter. Sure, it should be unique yet not revealimg a pattern ("goofy" is ok, "gawker" is not) but there is no need for the user to pass crypto 101. This for those 1.5m that were just A target; Nick Denton, OTH, was THE target and it was just matter of time for him to get pwned. >BTW Do you use the same password on your Gawker account elsewhere? I had to check the other day. I opened that account to leave one comment on lifehacker (that was never approved, actually) and then forgot about it. Turns out the password was safe enough but my mistake there was to use an email address I cared about. Now I have a less important email address and a supergenpass for everything, except gmail/facebook/dropbox and the other things I care about, for which I have better passwords.

jasonjei 16y ago

It's an interesting concept because passwords could be infinitely more secure if everything adopted a two-factor authentication system with something physical that you carried around like an RSA SecurID. Unfortunately, even that system risks being compromised, and like the sheet of paper, highly inconvenient. But on the other hand, your garage door works with a rolling keY too, and you're also SOL if you lose your opener (unless you, ironically, have a keypad).

kgo 16y ago
I did some consulting work at a big pharma company. And they solved the whole problem of someone stealing (or more likely losing) a RSA key by keeping all the keys at the helpdesk! You just called up, said you need the ID, and they read you the number over the phone... Me: "Hi I'm XXX and I need the RSA key for COMPANY X." Helpdesk: "Okay... It's on the board here somewhere... Found it... It's down to the last bar. Let me wait until it flips... Okay. Six bars... 643332." Me: "Thanks a million."

s2r2 16y ago

http://en.wikipedia.org/wiki/Shamirs_Secret_Sharing http://en.wikipedia.org/wiki/Shamirs_Secret_Sharing Write parts of your password down in several places, collect some of them (say, 8 of 10) to reconstruct it (completely!) if you've forgotten it; let someone who finds your wallet with one part of it know nothing.

deleted 16y ago

[deleted]

jcromartie 16y ago

I wrote a quick Ruby script that prints out a tabula recta for passwords. Enjoy! https://gist.github.com/745446 https://gist.github.com/745446

klochner 16y ago

My policy: - lame passwords for sites I don't care about (e.g., 'insecure') - the same password for sites with semi-sensitive information (e.g., facebook) - unique passwords for bank accounts, servers, etc. So I try to strike a balance between difficulty in remembering & security.

techbio 16y ago
Thanks for spelling that out entirely clearly.
kanru 16y ago
If once one of your password leaked, all sites with the secure level are unsafe then.
bigiain 16y ago
The thing that's bitten me on the ass a few times with that strategy is failing to upgrade sites from "I don't care about" status. I'll use the 'insecure' password to drop a comment on an interesting discussion on a site I've just found - like, say HackerNews or Twitter, then two years later I'm still participating in the community there, and it _could_ have still had the password I used that time to comment on a ValleyWag story. All of a sudden I _do_ care a bit about any reputation I might have. I was fortunate this time not to have any sites I cared about still using the same old password Gawker leaked (mainly 'cause I'd learned that lesson when my twitterstream started spamming acai berry sites when PerlMonks exposed my low-grade password back then.) I think Schenier's right - the world isn't a place where "remembering passwords" works any more. We need too many of them and we don't have enough control over how other people store them. A password safe with a strong passphrase backed up by somethig like dropbox or zumodrive is probably a minimum sensible approach now. Some care is needed with the devices you access that password safe on, and awareness of how software like browsers or your OS caches and stores any passwords it sees you use. Even with a properly secured password safe, a fair number of my logins are probably hosed if I lose my laptop... Firefox, Chrome Safari, Mail.app, Twitter clients, IM clients, IRC programs, FTP programs - all of them store credentials for me, _mostly_ in Mac OS X's keychain, but not in a "reliable enough way" to be considered "secure" if the physical hardware is in someone else's possession.

techbio 16y ago

Post-IT pswds.

DenisM 16y ago

Write them down to a file, and encrypt the file with a single passphrase. You only need to remember one thing. There are many tools that let you do that on your mobile phone of choice, including my own http://memengo.com http://memengo.com which has a benefit of also including the online backup feature in case you lose your phone.

silversmith 16y ago
Mobile phones get lost. Pieces of paper too. Online services die off. And then, you might want to log in from your mates computer. For me, the only usable password generation methods are those that fit in my mind.

ankimal 16y ago

What happens when you lose your laptop or netbook or whatever handy device you use to browse the web? Are you then leaving it to the OS login screen to protect everything? I d rather have passwords I remember in my head. If I forget often, I click the reset button/forgot your password. Whats more, I generally visit important places more often than unimportant ones, so I wont forget my important passwords. Also, start using sites like mint.com. Instead of logging into your bank account, log into mint to check balance and expenditures. Lets face it, none of this is every gonna keep you totally out of trouble. If you re so paranoid (aka my security professor at school), shut all your online accounts down.

jhuckestein 16y ago

I like the direction, but the obvious caveat are websites or weird legacy systems that don't allow you to have certain characters in your password or otherwise restrict it. And then there's the whole trouble of sites that require a username that you need to remember and that is usually restricted in ridiculous ways.

giberson 16y ago

I employ what I like to call "Personal Hashing". Think of it like the human version of md5. I've come up with an easy to remember, easy to compute (work done in my head), hashing system that I use to generate passwords for all my accounts. The power of this method is that it generates strong passwords, and is easy to remember. Take for example, and this is just a sample not my own personal hash formula, the following mechanism: key = username 1) r = rot2(key) 2) password = vowelreplace(r) [a4,e3,i1,o0,u_] In this example, I apply a rotation of 2 letters to the input key, then replace the vowels in the result with numbers. A sample use case might be for an amazon account. Username: johnsmith Password Key: johnsmith Password Phase 1 (rot2): lqjpuokvj Password Phase 2 (vowelreplace): lqjp_0kvj We are quite capable of remembering simple formulas which we can use to generate our own passwords on demand. What's best is the formula exists in our heads, and can never be discovered laying around.

Sapient 16y ago
I may be missing something, but doesn't this give you the same password for all accounts with the username johnsmith?

sigil 16y ago

I generate a new random but semi-pronounceable password for every account using apg (http://www.adel.nursat.kz/apg/ http://www.adel.nursat.kz/apg/), then store it in one of several gpg-encrypted, replicated master password files. The first few times I use a newly generated password, I have to look it up in a master file. It's weird how quickly semi-pronounceable nonsense + some symbols get stuck in your head though.

16s 16y ago

I've been doing this: echo -n "A long sentence I can recall. site_name" | sha1sum I use the sha1sum from that as my password. site_name may be hackernews, slashdot, home, etc. I can break them in half (20 chars) or quarters (10 chars) if the site can't accept a 40 char password. Also I can add a period on the end if the site requires special chars. These are strong passwords and unique for each site. Works great on Windows Linux and Macs. All I need to do is recall my sentence (with proper punctuation).

crux_ 16y ago
Not to be snarky, but isn't your master password now sitting there, plaintext, in your command-line history? (Worse: when you accidentally do this in a terminal that's remoted somewhere.)
- 16s 16y ago
  See my reply below. I seldom do it in a terminal and when I do only on my home machines. The command above is for explanation. If I showed you my app without that explanation, it wouldn't be the same.
zcid 16y ago
While my method isn't as secure as your most likely is, I prefer a simpler algorithm based upon the site name. I can perform my algorithm in my head and enter a password quickly and without having to refer to a terminal or another program. Btw, do you ever worry that your command history might be accessed to discover your passwords?
- 16s 16y ago
  I use an app I wrote to do the sha1 so the sentence is not hanging around in bash history, but I do rely on the cmd prompt at times on computers at my house. Here's a screeshot of the app: http://i.imgur.com/tz255.png http://i.imgur.com/tz255.png No one but me uses it. So it's bare bones.
  - 16y ago

maw 16y ago

I don't write my passwords down, but I do use reminders in a code of sorts. An example: I have an account with the bank Bancomer. In Spanish, "comer" means to eat, so I refer to it as "eßenbanque". (I know it's "essen"; nobody likely to find my list would recognize the ß, though; it would be mistaken for a B.) If my password were "l4rryb1rd" (it's not) I might render it as "oiseaulázaro", just enough of a reminder, while still misleading. This scheme might not work so well in, say, Brussels, but here in Monolingüilandia I think it's reasonable, although I do wonder from time to time just how sound it really is.

pavel_lishin 16y ago
I use something vaguely similar for my passwords, but with Russian instead of spanish/german. Fun fact: the password based on Russian transliteration that looks NOTHING like any English word I've seen (imagine "cexuqakr3") trips the linux "too close to dictionary word!" warning while a less secure password that's based on two english words (imagine "bellykitten13") doesn't.

goldenthunder 16y ago

Another good way store passwords is to memorize a simple algorithm based on the topic of your password. Example: - last 3 letters - a static symbol (let's use %) - @ if it's online / & if it's not - 3rd 1st 4th letter of topic in Capital-lower-Capital format - follow with a short string to increase length and stump bruteforces (lets use gold158) So my password for hackernews would be: - ews - % - @ - ChK - gold158 ews%@ChKgold158 I'm no security expert, but that seems to be pretty secure and it will be different for each password. You won't ever be in trouble if you forget a password and it doesn't require you to carry around written passwords. If you scramble it a little better than I did in my example, it will look random and no one will try to "reverse engineer" your algorithm. (So when someone needs your password temporarily, you can tell them)

deleted 16y ago

[deleted]

naner 16y ago

Anyone else try to log into John's HN account just to make sure he didn't make a very bad mistake (by posting the actual sheet he uses)?

FrankBlack 16y ago

I'll get my mom on this right away. :)

rapind 16y ago

I use a great little tool called PasswordMaker that I actually found in the comments of a thread here a long time ago. Here's a brief summary: http://blog.rapin.com/better-authentication-password-management http://blog.rapin.com/better-authentication-password-managem...

sullof 16y ago

I think that using password schemes is bad. Because in order to be useful, the method needs to be fast, simple and replicable. Suppose that someone creates a fake website in order to grab one of your smart passwords. If he understands that you use a method, he will try to deconstruct the method based on the fact that his website surely is included in some manner in the password itself. Also, since many people who use these methods tend to divulge them to the community, there isn't even a need to create a fake website to understand your passwords. The only solution that really works is to use a password manager. My favorite obviously is Passpack, because I am a co-founder, but regardless of which software you choose the important thing is that you use it. My advice is not to relay on any clever schemes because you may be in for a bad surprise.

devinfoley 16y ago

"Write them down and keep them in your wallet because you are good at securing your wallet." I'm having a very difficult time articulating just how horrible this idea is. Now if somebody compromises your password list, by either finding or stealing your wallet, they also get all of your personal and banking information as well! There is a reason that the government advises people not to carry their Social Security cards in their wallet (http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/446/~/carrying-a-social-security-card-in-a-wallet http://ssa-custhelp.ssa.gov/app/answers/detail/a_id/446/~/ca...). I use Wallet, a password manager/generator that's available for OS X and iOS, supports encryption, and syncs between devices automatically. I use a different random, strong password for all of my accounts, and it's easier to manage than keeping lists of passwords. Works for me.

desigooner 16y ago

for something easy to use, I use character names from foreign films and texts, modified with a certain character replacement and displacement..