5 ms·

Ask HN: Tips for generating easy to remember but difficult to crack passwords

5 points by the-mitr 3y ago

What strategies you use to create new passwords. At times I have to help several people (who are not tech savvy) to create login/password for different services. What tips would you give to such people to create passwords which are easy to remember but difficult to crack?

deleted 3y ago
[deleted]
MattGaiser 3y ago
Pure length. Write whole phrases.
tony-allan 3y ago
https://xkcd.com/936/ https://xkcd.com/936/
- gladiatr72 3y ago
  Or https://xkcd.com/538/ https://xkcd.com/538/
- muzani 3y ago
  Highly vulnerable to dictionary attacks though. Toss a punctuation in there at least.
  - cpach 3y ago
    Not convinced TBH. If the words are chosen randomly from a large dictionary, it should be fine. See https://security.stackexchange.com/questions/62832/is-the-oft-cited-xkcd-scheme-no-longer-good-advice https://security.stackexchange.com/questions/62832/is-the-of...
scrapheap 3y ago
Back in the days before shared password manager systems were a thing I was asked by an auditor how we shared the passwords for all our servers and services. I simply told them that we wrote them down on pieces of paper and locked them in our safe. They replied that all they needed to do then was to break into the safe to get access to our machines. That was when my colleague replied "Sure, you could do that - but you'd be wasting your time as the safe is in the server room, so you'd already have physical access to the servers" If someone can't handle a password manager then writing down a longer more complex password and locking it in drawer is still better than picking a simpler password.
hnthrowaway0315 3y ago
the-mitr19860504@hackernews How good does it look?
BjoernKW 3y ago
These days, password managers such as 1Password are easy enough to use even for non-tech-savvy people. Other than that, although the process can become tedious when applied manually to a multitude of passwords, diceware helps with generating easy-to-remember passwords: https://diceware.dmuth.org/ https://diceware.dmuth.org/ https://blog.1password.com/toward-better-master-passwords/ https://blog.1password.com/toward-better-master-passwords/ You probably still want to keep a secure record of those somewhere, which is where password managers come in handy again.
j10u 3y ago
I use to explain my strategy to friends and over time I've changed from words to short phrases. What I do is to have passwords divided in two parts: one constant, one variable The constant part is a phrase I can easily remember and the variable part is a reference to the usage of the password, so for example: - ILikeDarkChocolateGmail - ILikeDarkChocolateApple - ILikeDarkChocolateWhatever and so on.
jqpabc123 3y ago
I have 3 base passwords --- easy, moderate and difficult. Easy is for junk I don't really care about. Moderate is for stuff I do care about but doesn't contain any personal info. Difficult is for things that involve personal info. Here is the fun part --- I have a 4th category called "critical" for extra security. In these cases, I combine the difficult base with one of the other two and then add a special context character at the end to indicate type. For example, with banking/money related stuff, I'll add [$]. Also, the easy password can be spelled either forwards or backwards. All together, I have about 40 different passwords that I use but I really only remember the 3 bases. Even when I am not sure, I can usually guess the correct one within 3 tries based on context --- the objective being to avoid getting locked out. For example, if it is a banking website, I know from the context that it ends with "$" and it contains the "difficult" base. Obviously not perfect but where security is concerned, nothing ever is.
- dalmo3 3y ago
  I used to have a very similar "system", until I locked myself out of an external hdd which I had veracrypt-ed with a super extra secure combination. After a few months without using that hdd I forgot the password, but because I knew the basic bits that formed the password I generated all the possible permutations and brute-forced my way back. :D The third time that happened I just decided to save the password on bitwarden...
  - jqpabc123 3y ago
    There is no rule that says you can't back up your passwords too. For backup, I create a file with shorthand clues up made up of the first letter of each base password. For example s..h.. Even if someone finds this, they still have a lot of work to do.
idontwantthis 3y ago
Have a messy desk, and use objects on the desk.
- tony-allan 3y ago
  And never clean your desk!
  - idontwantthis 3y ago
    The point of the password is that it’s easy to remember so you can clean up and you’ll never forget your pencilgummousepaper password.
bilalel 3y ago
I would pick a word or name, and for each letter of the given word you create a sentences beginning with each letter. It doesn't need to make sense, you just need to make it easy to remember. Bonus point by adding a number (like a year date related to the word/name) and by separating each word with a special character. For example : Alice Amendment%Liability%Indicates%Cute%Energy2006
pawelduda 3y ago
Use password manager, generate long ass random passwords, never have to remember them
- tony-allan 3y ago
  Or just four words with a symbol. Most password managers can create this pattern. Very handy if you ever need to retype a password.
solardev 3y ago
Why memorize passwords? Put them on a password manager, either a third-party one or the ones built into Chrome/Firefox/Safari/macOS/Windows. They often have passkey support too.

5 points by the-mitr 3y ago

deleted 3y ago

[deleted]

MattGaiser 3y ago

Pure length. Write whole phrases.

tony-allan 3y ago

https://xkcd.com/936/ https://xkcd.com/936/

gladiatr72 3y ago
Or https://xkcd.com/538/ https://xkcd.com/538/
muzani 3y ago
Highly vulnerable to dictionary attacks though. Toss a punctuation in there at least.
- cpach 3y ago
  Not convinced TBH. If the words are chosen randomly from a large dictionary, it should be fine. See https://security.stackexchange.com/questions/62832/is-the-oft-cited-xkcd-scheme-no-longer-good-advice https://security.stackexchange.com/questions/62832/is-the-of...

scrapheap 3y ago

Back in the days before shared password manager systems were a thing I was asked by an auditor how we shared the passwords for all our servers and services. I simply told them that we wrote them down on pieces of paper and locked them in our safe. They replied that all they needed to do then was to break into the safe to get access to our machines. That was when my colleague replied "Sure, you could do that - but you'd be wasting your time as the safe is in the server room, so you'd already have physical access to the servers" If someone can't handle a password manager then writing down a longer more complex password and locking it in drawer is still better than picking a simpler password.

hnthrowaway0315 3y ago

the-mitr19860504@hackernews How good does it look?

BjoernKW 3y ago

These days, password managers such as 1Password are easy enough to use even for non-tech-savvy people. Other than that, although the process can become tedious when applied manually to a multitude of passwords, diceware helps with generating easy-to-remember passwords: https://diceware.dmuth.org/ https://diceware.dmuth.org/ https://blog.1password.com/toward-better-master-passwords/ https://blog.1password.com/toward-better-master-passwords/ You probably still want to keep a secure record of those somewhere, which is where password managers come in handy again.

j10u 3y ago

I use to explain my strategy to friends and over time I've changed from words to short phrases. What I do is to have passwords divided in two parts: one constant, one variable The constant part is a phrase I can easily remember and the variable part is a reference to the usage of the password, so for example: - ILikeDarkChocolateGmail - ILikeDarkChocolateApple - ILikeDarkChocolateWhatever and so on.

jqpabc123 3y ago

I have 3 base passwords --- easy, moderate and difficult. Easy is for junk I don't really care about. Moderate is for stuff I do care about but doesn't contain any personal info. Difficult is for things that involve personal info. Here is the fun part --- I have a 4th category called "critical" for extra security. In these cases, I combine the difficult base with one of the other two and then add a special context character at the end to indicate type. For example, with banking/money related stuff, I'll add [$]. Also, the easy password can be spelled either forwards or backwards. All together, I have about 40 different passwords that I use but I really only remember the 3 bases. Even when I am not sure, I can usually guess the correct one within 3 tries based on context --- the objective being to avoid getting locked out. For example, if it is a banking website, I know from the context that it ends with "$" and it contains the "difficult" base. Obviously not perfect but where security is concerned, nothing ever is.

dalmo3 3y ago
I used to have a very similar "system", until I locked myself out of an external hdd which I had veracrypt-ed with a super extra secure combination. After a few months without using that hdd I forgot the password, but because I knew the basic bits that formed the password I generated all the possible permutations and brute-forced my way back. :D The third time that happened I just decided to save the password on bitwarden...
- jqpabc123 3y ago
  There is no rule that says you can't back up your passwords too. For backup, I create a file with shorthand clues up made up of the first letter of each base password. For example s..h.. Even if someone finds this, they still have a lot of work to do.

idontwantthis 3y ago

Have a messy desk, and use objects on the desk.

tony-allan 3y ago
And never clean your desk!
- idontwantthis 3y ago
  The point of the password is that it’s easy to remember so you can clean up and you’ll never forget your pencilgummousepaper password.

bilalel 3y ago

I would pick a word or name, and for each letter of the given word you create a sentences beginning with each letter. It doesn't need to make sense, you just need to make it easy to remember. Bonus point by adding a number (like a year date related to the word/name) and by separating each word with a special character. For example : Alice Amendment%Liability%Indicates%Cute%Energy2006

pawelduda 3y ago

Use password manager, generate long ass random passwords, never have to remember them

tony-allan 3y ago
Or just four words with a symbol. Most password managers can create this pattern. Very handy if you ever need to retype a password.

solardev 3y ago

Why memorize passwords? Put them on a password manager, either a third-party one or the ones built into Chrome/Firefox/Safari/macOS/Windows. They often have passkey support too.