7 ms·

please memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7

by ouid 7y ago

hwbehrens 7y ago
Sorry, I've already been asked to memorize a 32-character string, so the slot has been filled. Coincidentally, it also starts with Z.
- FrozenTuna 7y ago
  Joke's on you! You just cut my brute force attack time in half! Only 1 billion years left!
  - IIAOPSW 7y ago
    Wait, was that capital Z or lowercase z?
bb88 7y ago
It's not just memorizing it, it's typing it every single time for every transaction that you want to do, if the administrators require it. The recommendation on one system I use is to force ssh and auth with username/pw for every git transaction. Because Security!
blotter_paper 7y ago
If I had a good reason to memorize this, I would have it down within a couple weeks. I'm pretty certain of this, as I do have private keys committed to memory. That's not even impressive, folks who have good memory palace practices could recite that string for you a few minutes after seeing it. I wouldn't expect it of the average user, but it is totally doable for a human of average intelligence -- it's just not something people care about. For long term storage (rather than a repeatedly entered password) it's even easier if you convert[0] it to an equally random yet more humanly memorable line of text: "duck fade ink love reality possible shown screw thing win invisible realize child suffocate somehow petal army nervous" [0]: https://brainwalletx.github.io/#converter https://brainwalletx.github.io/#converter
jerf 7y ago
Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Zaphod Beeblebrox wears 3 hats. He gives 1 to Ford. Why did he do that? He only has 2 heads. Xavier can't read Zaphod's mind now. (Does he even want to?) ZBw3hHg1tFWdhdt?Hoh2hXcrZmn(Dhewt?) That's 35. I could have that mostly memorized in a day's relatively normal usage, and definitely have it by a week. I have some rules I apply, like numbers -> their digits, periods are "free" but the other punctuation goes in, etc. Doesn't much matter what your rules are, as long as you're consistent. Technically, this is less random that a truly random password, because rather than drawing uniformly from the space of possible symbols, you're tilted in the direction of what words can start with and some other things like that. I tend to just make up for that by swinging more entropy at the problem, and trying to work in some Xs and Zs and unusual symbols, and figure that it gets me close enough. One trick to this: If you find in the first day that you're consistently remembering the phrase differently than you first laid it out, just take the hint and change the password.
- Insanity 7y ago
  How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?
  - nwallin 7y ago
    I do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does. I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.
  - jerf 7y ago
    I don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20. It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain. But if passphrases work better for you, by all means, please do. Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.
AllegedAlec 7y ago
> writes it down in his phone, protected by a 4 digit pin code
- smacktoward 7y ago
  In fairness, if you have a good password manager on that phone, that password will be protected by not just the device's unlock PIN but the password vault's master password as well, along with potentially other layers of added protection as well (a second factor to unlock the password vault, biometric authentication to unlock the vault or the device, etc.) But almost nobody uses a good password manager, so... yeah.

please memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7

by ouid 7y ago

please memorize: ZBkhTG1mchw7tr5bdKqknGGqFifuGDi7

Sorry, I've already been asked to memorize a 32-character string, so the slot has been filled. Coincidentally, it also starts with Z.

FrozenTuna 7y ago
Joke's on you! You just cut my brute force attack time in half! Only 1 billion years left!
- IIAOPSW 7y ago
  Wait, was that capital Z or lowercase z?

bb88 7y ago

It's not just memorizing it, it's typing it every single time for every transaction that you want to do, if the administrators require it. The recommendation on one system I use is to force ssh and auth with username/pw for every git transaction. Because Security!

blotter_paper 7y ago

If I had a good reason to memorize this, I would have it down within a couple weeks. I'm pretty certain of this, as I do have private keys committed to memory. That's not even impressive, folks who have good memory palace practices could recite that string for you a few minutes after seeing it. I wouldn't expect it of the average user, but it is totally doable for a human of average intelligence -- it's just not something people care about. For long term storage (rather than a repeatedly entered password) it's even easier if you convert[0] it to an equally random yet more humanly memorable line of text: "duck fade ink love reality possible shown screw thing win invisible realize child suffocate somehow petal army nervous" [0]: https://brainwalletx.github.io/#converter https://brainwalletx.github.io/#converter

jerf 7y ago

Zaphod Beeblebrox's kite harasses Tuscon. Great, one more collapsing home. Why? 7 termites risk 5 bad days. Knight's queen kills narcs; Good Game queen. Fighting inside futons upends Greater Detroit in 7. But that's because you forced the choice on me, and I'm only willing to work so hard for a Hacker News post. Ideally, you turn it into one coherent story. If I can choose my password, and I usually can after all: Zaphod Beeblebrox wears 3 hats. He gives 1 to Ford. Why did he do that? He only has 2 heads. Xavier can't read Zaphod's mind now. (Does he even want to?) ZBw3hHg1tFWdhdt?Hoh2hXcrZmn(Dhewt?) That's 35. I could have that mostly memorized in a day's relatively normal usage, and definitely have it by a week. I have some rules I apply, like numbers -> their digits, periods are "free" but the other punctuation goes in, etc. Doesn't much matter what your rules are, as long as you're consistent. Technically, this is less random that a truly random password, because rather than drawing uniformly from the space of possible symbols, you're tilted in the direction of what words can start with and some other things like that. I tend to just make up for that by swinging more entropy at the problem, and trying to work in some Xs and Zs and unusual symbols, and figure that it gets me close enough. One trick to this: If you find in the first day that you're consistently remembering the phrase differently than you first laid it out, just take the hint and change the password.

Insanity 7y ago
How fast can you enter that password? Like, is it a reasonable time or are you basically pecking at your keys?
- nwallin 7y ago
  I do passwords this way. At first, it's pretty slow, but after a while it's muscle memory: my fingers know my passwords better than my brain does. I don't do passwords this way at work anymore, because they make us change it every 90 days. I just use keyboard patterns, and shift the pattern to the right for each successive password. Seriously people, expiring passwords is an idiotic idea.
- jerf 7y ago
  I don't actually use 35-char passwords. That was just to answer the challenge. Mine are more on the order of 20. It's fairly fast, actually. One of the things I've decided to do is trade some entropy for having only lower case letters and the minimum symbol count, because what tended to screw me up most was synchronizing the shift key with the rest of the password... which I suppose also gives a clue about the speed. It's at least no slower than a passphrase of equivalent strength, and it fits my brain. But if passphrases work better for you, by all means, please do. Also, I have a password manager. I only have about 4 of these at any given time, and I can afford the cognitive burden of ensuring they are all very strong. It'd be a different problem otherwise.

AllegedAlec 7y ago

> writes it down in his phone, protected by a 4 digit pin code

smacktoward 7y ago
In fairness, if you have a good password manager on that phone, that password will be protected by not just the device's unlock PIN but the password vault's master password as well, along with potentially other layers of added protection as well (a second factor to unlock the password vault, biometric authentication to unlock the vault or the device, etc.) But almost nobody uses a good password manager, so... yeah.