6 ms·

good article on how to fix insecure passwords - http://www.slate.com/articles/technology/technology/2009/07/fix_your_terrible_insecure_passwords_in_five_minute

good article on how to fix insecure passwords - http://www.slate.com/articles/technology/technology/2009/07/fix_your_terrible_insecure_passwords_in_five_minutes.html http://www.slate.com/articles/technology/technology/2009/07/... take a phrase - ask not what you can do for your country -> Anwycd4yc for each site mix in some letters from the domain, ie 2nd two letters of amazon -> maAnwycd4yc bingo - easy to remember - strong - unique for each site password safe like keypass is also good. occasionally you get services with silly password rules where your generator function doesn't return a valid password. still important to have 2 factor on that one email account that has your banks etc., otherwise one encounter with one of these bad boys and it's all over - http://www.google.com/search?q=usb+keylogger&tbm=isch http://www.google.com/search?q=usb+keylogger&tbm=isch

RyanMcGreal 15y ago
Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.
- corin_ 15y ago
  If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example. If I have maAskNotWhatYouCanDoForYourCountry then someone seeing it could possible guess the relevance of the ma, and try ew or hn, etc. on this site. Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?
- noahc 15y ago
  Some websites cut your password off at twelve or even six characters. What this means is that your long password when you enter it into the password form is only 'AskNot'. That's not so hard to brute force. To avoid confusion some websites let you type in x characters, but only take the first y characters.
- RockyMcNuts 15y ago
  That works too. My main reason is: a pain to type on a mobile device As others mentioned: may also get truncated or not accepted as a valid password due to length; if you added Amazon in there somewhere it might be easy to reverse engineer for other sites
- hugh3 15y ago
  Well, I would think one should avoid using a famous quotation outright. My passwords tend to be based off nonsense sentences. Personalized nonsense I can remember, but nonsense nonetheless.
CGamesPlay 15y ago
XKCD has an infographic on password security: http://xkcd.com/936/ http://xkcd.com/936/
- gburt 15y ago
  This isn't really true. Its four English words, which is four "choice variables" if you're sampling from an English words character set.
  - blahedo 15y ago
    Four choice variables each with tens of thousands of possibilities, yes, yielding greater entropy at lower cognitive cost.
    - sliverstorm 15y ago
      Put another way, Oxford lists over 250000 words in English. There are 26 letters. So we have: 250000^4 = 4 x 10^21 combinations vs 26^(~10 characters) = ~10^14 combinations Even counting for capitolization and numbers and symbols, you get something like: 72^(~10) = 4 x 10^18
      - Tichy 15y ago
        Except that nobody will use the full range of the Oxford dictionary.
        sliverstorm 15y ago
        Yeah, well, even if you use 1/8 of the Oxford dictionary you're still around parity with a 10-symbol password using lower case, capitols, symbols and numbers. At which point we fall back to Randall's observation- one is a whole hell of a lot easier to remember than the other.
  - kragen 15y ago
    The comic actually had a mouseover punch line about people like you: > To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize. You are the "someone who does not". Please do the calculations described in the comic and tell us what your results are.
pixelcloud 15y ago
It's really quite amazing that I can use 2 factor authentication both my google accounts and facebook. When I see people get "hacked" and lose access to their email and facebook I always advise them to turn it on. Ironically, they decide that its too much work to protect themselves and would rather take the risk. For non-techies I think that mentality is quite common, its quite scary. I wonder if its possible to have an user friendly, secure authentication system.
- knieveltech 15y ago
  User friendly secure system: a brick with a smiley face painted on it.
- itsnotvalid 15y ago
  They just don't know the merits of two factor authentication. That's said, however, as both services allows users to "remember" the sessions for a lengthier period of time, it's still insecure to sign in two those services even with two-factor authentication.
  - mkjones 15y ago
    What attack can you make with the "remembered browsers" feature that you couldn't do without it? Stealing someone's computer and password and doing things with that?
runn1ng 15y ago
I personally use a really stupid trick for remembering my passwords - use profanities, vulgarities and "things that you shouldn't say out loud" in your passwords and mix them with something silly. They are infinitely easier to remember then.
- BadiPod 15y ago
  That's great until you're on the phone with customer service and you have to tell them your password. Kind of embarrassing.
  - bobds 15y ago
    They should be embarassed about asking you to give your password over the phone.
  - jarek 15y ago
    I've never had to give a web system password over the phone. In which cases would this happen?
  - runn1ng 15y ago
    Yeah, I actually had to send one of my passwords to one of my friends in SMS (I know, totally insecure etc, but time was more critical at that time than security). I felt a little.... embarrassed afterwards.
  - philwelch 15y ago
    I'm far more used to emails cautioning not to reveal my password to anyone since they will never ask for it than to having my password legitimately asked for.
metachris 15y ago
This is a silly advice. When you do this for lots of websites you most likely won't remember all of them correctly. I think the best solution is using a password manager (KeepassX, Lastpass, etc) which store the passwords in an encrypted file (only requiring one master password). Put that encrypted file into Dropbox and the passwords are available across all your devices as well as online.
- jaylevitt 15y ago
  Actually, I do exactly this, and I do remember them all correctly. The key is to be consistent about WHAT you mix in from the site. I also use 1Password, but it's frankly a pain on the iPhone (there's no good way for them to integrate with Mobile Safari), and it's handy to be able to use my passwords on others' computers without having to look them up.

RyanMcGreal 15y ago

Why not just make your password 'AskNotWhatYouCanDoForYourCountry'? That seems pretty strong to me.

corin_ 15y ago
If someone gets hold of your password from one source, the goal is that they won't be able to use it in other places, hence the "ma" from Amazon in his example. If I have maAskNotWhatYouCanDoForYourCountry then someone seeing it could possible guess the relevance of the ma, and try ew or hn, etc. on this site. Woth maAnwycd4yc on the other hand, without being told, are you going to guess that maybe it's a generic password with a small site-specific portion?
noahc 15y ago
Some websites cut your password off at twelve or even six characters. What this means is that your long password when you enter it into the password form is only 'AskNot'. That's not so hard to brute force. To avoid confusion some websites let you type in x characters, but only take the first y characters.
RockyMcNuts 15y ago
That works too. My main reason is: a pain to type on a mobile device As others mentioned: may also get truncated or not accepted as a valid password due to length; if you added Amazon in there somewhere it might be easy to reverse engineer for other sites
hugh3 15y ago
Well, I would think one should avoid using a famous quotation outright. My passwords tend to be based off nonsense sentences. Personalized nonsense I can remember, but nonsense nonetheless.

CGamesPlay 15y ago

XKCD has an infographic on password security: http://xkcd.com/936/ http://xkcd.com/936/

gburt 15y ago
This isn't really true. Its four English words, which is four "choice variables" if you're sampling from an English words character set.
- blahedo 15y ago
  Four choice variables each with tens of thousands of possibilities, yes, yielding greater entropy at lower cognitive cost.
  - sliverstorm 15y ago
    Put another way, Oxford lists over 250000 words in English. There are 26 letters. So we have: 250000^4 = 4 x 10^21 combinations vs 26^(~10 characters) = ~10^14 combinations Even counting for capitolization and numbers and symbols, you get something like: 72^(~10) = 4 x 10^18
    - Tichy 15y ago
      Except that nobody will use the full range of the Oxford dictionary.
      - sliverstorm 15y ago
        Yeah, well, even if you use 1/8 of the Oxford dictionary you're still around parity with a 10-symbol password using lower case, capitols, symbols and numbers. At which point we fall back to Randall's observation- one is a whole hell of a lot easier to remember than the other.
- kragen 15y ago
  The comic actually had a mouseover punch line about people like you: > To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize. You are the "someone who does not". Please do the calculations described in the comic and tell us what your results are.

pixelcloud 15y ago

It's really quite amazing that I can use 2 factor authentication both my google accounts and facebook. When I see people get "hacked" and lose access to their email and facebook I always advise them to turn it on. Ironically, they decide that its too much work to protect themselves and would rather take the risk. For non-techies I think that mentality is quite common, its quite scary. I wonder if its possible to have an user friendly, secure authentication system.

knieveltech 15y ago
User friendly secure system: a brick with a smiley face painted on it.
itsnotvalid 15y ago
They just don't know the merits of two factor authentication. That's said, however, as both services allows users to "remember" the sessions for a lengthier period of time, it's still insecure to sign in two those services even with two-factor authentication.
- mkjones 15y ago
  What attack can you make with the "remembered browsers" feature that you couldn't do without it? Stealing someone's computer and password and doing things with that?

runn1ng 15y ago

I personally use a really stupid trick for remembering my passwords - use profanities, vulgarities and "things that you shouldn't say out loud" in your passwords and mix them with something silly. They are infinitely easier to remember then.

BadiPod 15y ago
That's great until you're on the phone with customer service and you have to tell them your password. Kind of embarrassing.
- bobds 15y ago
  They should be embarassed about asking you to give your password over the phone.
- jarek 15y ago
  I've never had to give a web system password over the phone. In which cases would this happen?
- runn1ng 15y ago
  Yeah, I actually had to send one of my passwords to one of my friends in SMS (I know, totally insecure etc, but time was more critical at that time than security). I felt a little.... embarrassed afterwards.
- philwelch 15y ago
  I'm far more used to emails cautioning not to reveal my password to anyone since they will never ask for it than to having my password legitimately asked for.

metachris 15y ago

This is a silly advice. When you do this for lots of websites you most likely won't remember all of them correctly. I think the best solution is using a password manager (KeepassX, Lastpass, etc) which store the passwords in an encrypted file (only requiring one master password). Put that encrypted file into Dropbox and the passwords are available across all your devices as well as online.

jaylevitt 15y ago
Actually, I do exactly this, and I do remember them all correctly. The key is to be consistent about WHAT you mix in from the site. I also use 1Password, but it's frankly a pain on the iPhone (there's no good way for them to integrate with Mobile Safari), and it's handy to be able to use my passwords on others' computers without having to look them up.