3 ms·

How do you usually direct people to generate passwords they'll need to remember?

by jmholla 4y ago

teddyh 4y ago
https://xkcd.com/936/ https://xkcd.com/936/
- joe_guy 4y ago
  That's really good advice if you use the same password for everything. It becomes untenable with the, what, hundred+ websites I have a login for, each with their own password.
  - teddyh 4y ago
    Then you need a password manager. OTOH, people in the old days used to memorize a lot of phone numbers, so remembering things is not as hard as you might think.
    - deleted 4y ago
      [deleted]
Aachen 4y ago
Password manager. The password for which you're best off randomly generating and memorizing if you're able (one of my grandparents can't remember a 4-digit banking PIN so that's a sticky note on the back of her card... do what one can). Also memorize, if possible, a few other important things like your bank password, or rely on 2FA for that, e.g.: we have a system where you log in with a reader for your card itself, so your password being stolen and your chip+pin being stolen is a risk I accept. If someone is after me specifically enough to get physical things out of my pocket, I'm not confident about resisting a rubber hose for that password / they can also install a keylogger. For generating a password, it just needs enough entropy if you calculate log(pool^elements)/log(2): - pick 6 actually random words (like in the xkcd) from a 7776-word dictionary like diceware, or some other combination that gets you at least 72 bits of randomness (so here it is log(7776^6)/log(2)), - or use a much shorter but slightly harder to remember set of random characters (a-z, A-Z, 0-9 would need 13 characters. If you don't want to bother with shift at all but include a few (10) symbols that don't need shift, add one character. Depending on the password manager, it would strengthen with a KDF, but that depends on details and remembering just a handful of 72+ bits of randomness should be attainable for most people if they use it regularly (at least once or twice a month after the memorization phase). I should really find a canonical source for this so I don't have to write this up every time. Not sure if Schneier has this somewhere but I looked at e.g. the Wikipedia on password strength (a source people would trust) and it's less explicit and also contained a pretty bad mistake for more than a year not so long ago...

How do you usually direct people to generate passwords they'll need to remember?

teddyh 4y ago

https://xkcd.com/936/ https://xkcd.com/936/

joe_guy 4y ago
That's really good advice if you use the same password for everything. It becomes untenable with the, what, hundred+ websites I have a login for, each with their own password.
- teddyh 4y ago
  Then you need a password manager. OTOH, people in the old days used to memorize a lot of phone numbers, so remembering things is not as hard as you might think.
  - deleted 4y ago
    [deleted]

Aachen 4y ago

Password manager. The password for which you're best off randomly generating and memorizing if you're able (one of my grandparents can't remember a 4-digit banking PIN so that's a sticky note on the back of her card... do what one can). Also memorize, if possible, a few other important things like your bank password, or rely on 2FA for that, e.g.: we have a system where you log in with a reader for your card itself, so your password being stolen and your chip+pin being stolen is a risk I accept. If someone is after me specifically enough to get physical things out of my pocket, I'm not confident about resisting a rubber hose for that password / they can also install a keylogger. For generating a password, it just needs enough entropy if you calculate log(pool^elements)/log(2): - pick 6 actually random words (like in the xkcd) from a 7776-word dictionary like diceware, or some other combination that gets you at least 72 bits of randomness (so here it is log(7776^6)/log(2)), - or use a much shorter but slightly harder to remember set of random characters (a-z, A-Z, 0-9 would need 13 characters. If you don't want to bother with shift at all but include a few (10) symbols that don't need shift, add one character. Depending on the password manager, it would strengthen with a KDF, but that depends on details and remembering just a handful of 72+ bits of randomness should be attainable for most people if they use it regularly (at least once or twice a month after the memorization phase). I should really find a canonical source for this so I don't have to write this up every time. Not sure if Schneier has this somewhere but I looked at e.g. the Wikipedia on password strength (a source people would trust) and it's less explicit and also contained a pretty bad mistake for more than a year not so long ago...